This is one of Cloudflares well documented tactics to force people to purchase their subscription services. I suspect but have no proof that it is overlooked by the authorities because an internet centralized under Cloudflare is easier to censor.
Why would cloudflare ddos you with their own servers? If they actually wanted to attack random sites to get them to become customers (very much doubt that conspiracy) they probably would use someone elses IP:s.
Deniability. The executives can claim third parties are abusing the platform while simultaneously enabling the abuse. Whether or not that’s true, the outcome is the same; cloudflare’s actions force smaller operators to switch to cloudflare.
So they switch to cloudflare free tier and uses cloudflares stuff for free.