> any service such as Cloudflare would need to be extremely aggressive in blocking

Cloudflare needs an algorithm to deduce the IPv6 prefix size controlled by a given entity, but the details of that algorithm are not obvious. You are jumping to the conclusion that they must be doing a bad job because the problem is challenging.

IPv4 abuse detection is also challenging because of (e.g.) the prevalence of CGNAT with multiple users sharing an IP address.

Which problem is harder? Which solution is better? I don't know, without a lot of proprietary data and analysis.