DDoS Cloudflare
Does Cloudflare notify the ISPs hosting the hacked IoTs so the bots can be blocked/rectified ?
I assume not so easy and might be collateral damage, although no doubt able to mitigate.
A cycnic would say not in Cloudflares interests to actually do that, but I expect long term it is as an extra service that can be charged for.