You've posted these links without much context, but yes, I do think Cloudflare does a pretty good job of backing up the specific claim that they'll absorb a large, random DDoS attack for you. (Although it doesn't seem like the attack in your last link could even have been attributed to any specific customer in the first place.)
Where things start to get shaky is if your site uses a lot of bandwidth for legitimate traffic, or otherwise uses the service in an unusual way. Personally I see it like an old shared hosting plan that will probably let you use some burst capacity if you get Slashdotted, but operates under a vague shared understanding that the service is only for "normal websites". (Which includes a lot of policies and content guidelines that only become problems if you show up on someone's "sort by usage descending" dashboard.)
I think publishing a specific amount of bandwidth that customers are allowed to consume would go a long way to putting R2 in the former category. Maybe that number is your maximum object size multiplied by your GET request limit, maybe it's your current total network capacity, maybe it's eight octillion zottabits per second.
