Unless they are on the Business or Enterprise plans CF is the only authoritative DNS for the domain. The TTL is 24h so changing the nameservers would not be a quick fix.
That might be OK. If people are not on a business or enterprise plan then is it safe to assume they are not hosting anything critical or revenue generating? Or if they are, is it safe to assume they are not a publicly traded company?