Speaking as a bystander, a more-charitable option might be: "DDoS protection is free for targets which fit a generic risk-profile and are targeted randomly or only for small-scale spite."

P.S.: In contrast, imagine a website dedicated to journalistic content about how {dictator} is a crook and a parasite that has made {country} weak and a joke to the rest of the world. If there's a regular nation-state level DDoS from nodes in {country}, Cloudflare might say: "Hey, uh, your situation is not normal anymore, and it's not exactly your fault be we are a business that needs to recoup costs..."