Can I just say...
...as a Cloudflare user, this is the website owners choice.
In Cloudflare, you as the owner of the site, get to choose your level of threat protection, even on the basic mode.
For example, if you try to get to my backend, outside of the UK, you're going to get blocked.
Same for accessing the front end from many countries (I only sell to the UK, so really don't care if China can't scrape the content).
However for legitimate traffic, there is multiple options on bot / malicious traffic detection, from js detection, captcha, blocking known bots etc etc.
My guess is a lot of these sites are enforcing strict blocking, after all, how many here can't get to the reg?