Therefore "working as intended" for you means wasting the time of many people around the world, who cannot be considered as "threats" by any definition and who certainly do not waste any resources on the "protected" sites, because they are using the sites exactly for their intended purpose.

It is true that this has never happened before, but this week Cloudflare has frequently blocked my access to a site where I am a paid subscriber, and where there is no doubt that my access pattern matches exactly what that site must have been designed for, i.e. the site hosts a database and I make a few queries on it each day, less than a dozen, spread over the entire day, where each query takes a couple of seconds at most.

Whoever has implemented a "threat" detection algorithm that decides that such a usage is a "threat" and not normal usage, must be completely incompetent.