Can it? I pull and push Github over ssh, which is an attack path that Cloudflare isn't built to mitigate. If it were strictly http and https, it would be a different story.

"Is there any reason not to use them if you're often a target and don't want to deal with it yourself?"

I don't think github became a target until very recently, and I imagine their corporate customers (using github enterprise) were unaffected by github.com uptime