Many web hosts do this. At <redacted UK-based LAMP host> we do both the WAF stuff (which Cloudflare don't actually do, unless you pay them), and your latter suggestion of read-only'ing accounts on discovery of vulnerabilities.

The unfortunate reality of the latter one is that it's going to break their site, probably, since we don't know what they run, and you can't just read only an entire account blindly without breaking something. We could do better there, but it will never be perfect in this environment.