Speaking as a bystander, a more-charitable option might be: "DDoS protection is free for targets which fit a generic risk-profile and are targeted randomly or only for small-scale spite."

P.S.: In contrast, imagine a website dedicated to journalistic content about how {dictator} is a crook and a parasite that has made {country} weak and a joke to the rest of the world. If there's a regular nation-state level DDoS from nodes in {country}, Cloudflare might say: "Hey, uh, your situation is not normal anymore, and it's not exactly your fault be we are a business that needs to recoup costs..."

Thats basically for everything. Do you think home insurance will pay if you burn down house every year. Or car insurance if you trash it few times a year. I see DDOS protection as kind of insurance for event happening once in a while, if it happens all the time one definitely needs something more than a free service.