git over ssh or an email interface are both core sourcehut features that seem like they wouldn't fit into cloudflare's standard https only model
I think specifically for Sourcehut, to survive the DDoS they likely don't need 100% feature parity. Right now you can't even load their webpage - the service is effectively entirely down and users are left guessing what's going on. Getting web services back online would be significant.
The point for them would be to get breathing room to figure out a better long term plan. When the immediacy is gone, they'll be in a much better negotiating position with Cloudflare (or alternatives) for non-standard features.
sr.ht does not support pushing to git repositories over HTTPS with a username+password — SSH keys are mandatory.
HTTP access is restricted to read-only operations (clone, pull, etc).
[0] https://web.archive.org/web/20231225152845/https://man.sr.ht...
It appears they restored HTTP services now, so perhaps they ended up taking that route. Their homepage lists details of the ongoing attack/outage and their current efforts. This is what should have been done immediately, I'm afraid to say.
Once the attack passes, they will then be in a better position to consider their options and negotiate with providers for long term solutions.