Does this effectively mean DDoS protection that's free until you actually use it?
P.S.: In contrast, imagine a website dedicated to journalistic content about how {dictator} is a crook and a parasite that has made {country} weak and a joke to the rest of the world. If there's a regular nation-state level DDoS from nodes in {country}, Cloudflare might say: "Hey, uh, your situation is not normal anymore, and it's not exactly your fault be we are a business that needs to recoup costs..."
In exactly none of the posts about these debacles did CloudFlare say anything of the sort. It’s always comic book villain levels of communication.
Warning: Insurance is not going to pay if YOU burn down your home /// even a little bit ///!!!
That reminds me of an NPR piece [0] discussing how a worrying number of people seem to be getting wrong/illegal tax-advice from "influencers" on TikTok etc. I'm sure a similar thing with insurance fraud either has happened or will happen eventually.
https://blog.cloudflare.com/unmetered-mitigation/
"Cloudflare mitigates record-breaking 71 million request-per-second DDoS attack"
https://blog.cloudflare.com/cloudflare-mitigates-record-brea...
"Mitigating a 754 Million PPS DDoS Attack Automatically"
https://blog.cloudflare.com/mitigating-a-754-million-pps-ddo...
Where things start to get shaky is if your site uses a lot of bandwidth for legitimate traffic, or otherwise uses the service in an unusual way. Personally I see it like an old shared hosting plan that will probably let you use some burst capacity if you get Slashdotted, but operates under a vague shared understanding that the service is only for "normal websites". (Which includes a lot of policies and content guidelines that only become problems if you show up on someone's "sort by usage descending" dashboard.)
I think publishing a specific amount of bandwidth that customers are allowed to consume would go a long way to putting R2 in the former category. Maybe that number is your maximum object size multiplied by your GET request limit, maybe it's your current total network capacity, maybe it's eight octillion zottabits per second.