It depends. A CDN-like approach wouldn't really work because all requests are different and legit, so plain old caching isn't going to cut it.

On the other hand, Cloudflare has quite some experience with DDoS protection, so they definitely have the right infrastructure in place to stop this kind of abuse. What is the bill going to be, though?

It will definitely help yes, I don't know as well why they are not using it. And probably work on auto-scaling as well, in case the API Requests are legit.

10,000 requests/seconds is nowadays an average number for load testing in the companies I work with, for websites / mobile apps deployed at this scale