Cloudflare throws a massive CDN blanket over you, but you're basically handing your whole traffic stack to a third‑party jitterbug with a "free‑tier" that throttles legit users during a surge.
Their WAF is a blunt‑instrument, Bot Fight Mode is a false‑positive nightmare, and any mis‑config can expose your origin.