I agree, default "Medium" firewall setting is the very first thing I change on a new site.

I use Cloudflare Pages, and having heard these sorts of stories from HN and other places, I did spend some time exploring the settings to ensure the largest number of people could access the site. My impression was that the default settings were pretty much the loosest options around. In particular, for Tor, I would have needed to manually enable to block (it's off by default), and even then, Cloudflare automatically generates a magnet link for each site they host, and allow Tor browser users to automatically redirect to those magnet links.

I agree that it's a bit opaque, but I think that comes with the territory. If Cloudflare could tell you exactly which groups were getting blocked, then DDOS protection wouldn't be so big a problem in the first place - you just select all the bad actors and block them, and you're fine.