AOL tried to spread the perception it was the internet and so should be the one chosing which internet resources were available for you. It wasn't really wasn't though. It was just a small walled garden in a bigger internet.
Cloudflare on the otherhand, by it's sheer cheap utility, has inserted itself between a significant number of the top websites (and other internet services to a lesser extent) on the internet as a whole. It acts as the gateway deciding if your client is on the approved list for access the resource. It has become what AOL always hoped to be. It's almost too big to fail now and likely will enshittify it's business model all the way to AOL levels in time.
ddos as a service providers (aka booters/stressers) proxy L7 request floods via VPN providers. At some point the VPN providers might actually care to kill off those accounts / better tighten up their free tiers, but they don't care at the moment.
I do. And that second part is false. Most users of cloudflare don't configure it and just run with the defaults. That means any browser that doesn't implement the latest bleeding edge features gets blocked. And it especially means, say, if you're science.org and you've applied cloudflare to your entire domain, that URL endpoints that are supposed to be hit by clients like RSS readers end up covered under the entire domain anti-bot block, and now the RSS URLs are incessibible to native feed readers and only paid feedly accounts are whitelisted and can accesss science.org/aaas hosted blog feeds. True story.