I don't think it's completely absurd. Of course it won't protect you against a determined attacker, but it can protect against some of the low hanging fruit... stuff like web form spam, email address harvesters, known XSS / SQL injection / WordPress vulnerability du jour.

Then there's a CDN / caching aspect. If you don't want to bother configuring your own cache servers they'll handle it for you. It sounds like they even try to figure out what's static content even if you don't set your cache headers properly, which is slightly risky but probably ok for a lot of configurations.

And they'll do something similar to SPDY for you ("Rocket Loader" https://www.cloudflare.com/press/2011-May-25-cloudflare-rock...)

I'd at least consider setting it up for my personal website/blog.