The accusation is that cloudflare also refuses to take down ddos for hire sites, which some interpret as them at least condoning such sites, and they benefit from those sites being up because it makes their services necessary. The counterargument to this is that cloudflare doesn't host any content and therefore shouldn't be subject to takedown requests, similar to how you wouldn't send takedown requests to Lumen Technologies (a tier 1 transit provider) because they provide transit to some VPS provider that ultimately hosts the ddos for hire site.

Most of the ddos as a service booter/stresser websites and front doors are on cloudflare.