FWIW, I'm used to seeing >95% from working with CDNetworks (and I believe that's even in their literature somewhere), which has a kind of (to borrow a term from a different kind of service) "supernode"-like model for their cache layer, proactively distributes cached resources, and does revalidation as a separate path from fetches.

As for their DoS "features", yes: they have a bunch of features because it makes them look like they are doing something worth value, but I am going to again remind you that somehow you never see websites that are using normal CDNs suddenly give up and give you an Akamai-branded captcha, and yet somehow they do not crumble under the weight of denial of service attacks; it just isn't the case that using CloudFlare is the only way to be safe from DDoS, and there's something weird about how the experience of using a CloudFlare website somehow is noticable.