Does it? I know the defaults can be overly sensitive, but I wouldn't call it impossible.
I have my site behind Cloudflare, using it's protections:
> ALPN, server accepted to use h2
> Server certificate:
> subject: C=US; ST=CA; L=San Francisco; O=Cloudflare, Inc.; CN=sni.cloudflaressl.com
> ...
> GET / HTTP/2
> Host: sixteenmm.org
But you won't find any issues streaming the videos on it under Tor. I, and several others, regularly do.
Yes, that's the difference between 99.9% and 100%. Cloudflare cited traffic percentages which match what most experienced site operators have seen, with a much higher percentage of malicious activity using Tor than most other networks and no easy way to have per-user reputation (that was the impetus for developing the “Privacy Pass” feature).
Here's what they said at the time, which also has some answers for your question about non-DoS problems:
> On the other hand, anonymity is also something that provides value to online attackers. Based on data across the CloudFlare network, 94% of requests that we see across the Tor network are per se malicious. That doesn’t mean they are visiting controversial content, but instead that they are automated requests designed to harm our customers. A large percentage of the comment spam, vulnerability scanning, ad click fraud, content scraping, and login scanning comes via the Tor network. To give you some sense, based on data from Project Honey Pot, 18% of global email spam, or approximately 6.5 trillion unwanted messages per year, begin with an automated bot harvesting email addresses via the Tor network.