> this means a court order can't block a single cloudflare site without blocking every cloudflare site

Not true. Cloudflare can't block only a single web site _by IP address_ but that's pretty common with IPv4, The same is true of Fastly and AWS and I'd be shocked if there's a mass-market CDN out there that has a unique IPv4 address per customer.

They can absolutely block any site they want at the application layer (SNI or Host header or whatever they use, IDK, I'm a network guy).