The problem with your argument is that CloudFlare didn’t act to benefit ordinary citizens, it acted to protect its shareholders from a material risk to the company. It’s always been the case that businesses have to choose who they do business with and that clients can take their business elsewhere if they don’t like how a company behaves, very much including demanding that other clients are dropped.
Companies started acting like they shouldn’t need to know what their clients are doing only 20 years ago and it’s given us widespread counterfeiting, scam robocalls and DDoS attacks. Of course they want to continue doing it, because they’re making money hand over fist. Doesn’t mean we should let them.
