I agree with you but many websites are still using Cloudlfare (including Bitcointalk), maybe because there is no better alternative for ddos attacks.
There are many good alternatives (Imperva, Sucuri, AWS Shield, DDoS-Guard and such), but people choose Cloudflare because it's free and straightforward to setup. The most cheap and secure alternative is to buy a ~5$/mo VPS from a top-tier provider like OVH or Hetzner (that include DDoS protection) to use it as a reverse-proxy along with a Let's Encrypt certificate. That's how some privacy-related projects avoid using Cloudflare while keeping their clearnet resources operational and protected.