[reisse]

As far as I understand, protecting from DDoS attacks is a big enough part of Cloudflare business. Doesn't it create the conflict of interest here? I can imagine how it makes sense for Cloudflare to facilitate DDoS attacks by sheer ignorance with plausible deniability, to sell more DDoS protection to the targets.

Using their own analogy, the real fire departments actively prevent fires by enforcing safety policies, not merely fighting existing ones. If fire department is paid only for the fires extinguished, they are strongly disincentivised to enforce safety policies.