They are, the actual cloudflare free tier (not the one they give to various "social good" sites, that's way better) is not actually that great when it comes to a "well executed" DDOS attack. I don't know the exact details, and I guess it's possible it changed in the last couple years, but it's what I've heard.

Interesting. Their messaging on that isn't great in that case. I've used them for years and was under the impression that their full DDoS suite (aside from case managers and such) was part of free tier.

I guess the one signal I had is that WAF is a paid product.