I don't disagree with you, but I think there's a bit of a difference between setting up an entire cloud infra to the point that you can phish people with it, and making a basic account on a random website to post some comments. Requiring KYC on a site like Reddit is obviously nonsense as at worst someone could make some mean anonymous comments, but we're now seeing Cloudflare being used as an end-to-end platform for sophisticated crime.

You've got to remember that those "free" cloud services are primarily intended as a way to do marketing. You try it out for free because the barrier to entry is so low, then you pay for it when you deploy it to prod. Alternatively: you start with it for free, then are tied to it when your site suddenly gets popular and they start extorting you.

For legitimate use KYC on something like Cloudflare really isn't that big of a deal, in my opinion. I already had to submit my real name and address for my domain registration, and the credit card used to pay for my hosting isn't exactly anonymous either. Heck, when I tried to switch to Hetzner they even asked for a copy of my ID card! We can pretend Cloudflare can't already figure out who I am, but we all know that isn't true.

And of course KYC isn't the only way to solve this. Cloudflare could've also chosen to give new (unpaying / unverified) users a restricted account, which would for example display a Cloudflare ad around it (like .tk domains back in the day), or restrict it to a certain IP range, or only display content after logging in, or after a click-through page. For the attack described in the article they could also force the potential user to supply a subdomain for the service to live on, so it isn't hidden behind Cloudflare's ".workers.dev" and ".pages.dev".

Cloudflare chooses not to do any of this - which in turn makes them the perfect platform for criminals. If that's what they want to, then that's totally fine - but then they should be treated like all the other "bulletproof hosting" organisations out there.