I do wish that the market would work as intended such that failures in handling abuse (e.g. frivolous accusations as we're plausibly seeing here) would lead to organizations moving away from Zoom to competitors, whether it's Teams or Meet or BlueJeans or whatever else. But unfortunately the friction of changing platforms is high, between sunk cost of contracts, needing to vet / compare multiple new systems, training on the use of new software, etc.
Meanwhile, the existing solution mostly just works 99% of the time.
(All this said -- even if CG-NAT is to blame for multiple students showing up with the same IP address, that should be tangential to the actual identification of abuse. Either there's a process failure (students aren't required to sign in), or Zoom's not logging or looking at the right things (e.g. display name changes).)
(Intended?! By whom?!)
In this case, the market is working exactly as markets are supposed to. Effectively dealing with abuse is expensive, and has no profit potential whatsoever.
The market will therefore penalize companies that spend money on dealing with abuse, and reward companies that do not. Economically, companies that manage to sweep abuse under the rug for the minimum possible cost will naturally dominate, and companies that spend the considerable investments needed to do a good job on it will eventually go to the wall.
If "market working as intended" has any meaning, maximizing profits is certainly it. It's very economically logical for a provider to not cater to the 1% or so abuse victims, who are expensive to handle, offer little revenue, and might stay with you anyway out of a lack of other places to go. It might be unfair, lack compassion, and be cruel to prioritize abusers over the abused, but none of these terms have any meaning by the metric of "markets"
But I see your point that the markets are working logically from the perspective of there being insufficient incentive for companies (well, Zoom at least) to invest in dealing with this issue. Negative press only goes so far, and it doesn't matter much when it's the dominant player in the market by far (in part due to design choices that facilitated these flaws -- minimized friction in the interest of accessibility also minimizes friction for malicious action).
If they use Cloudflare, then that block is dumb. Sites behind Cloudflare are able to see the real IP of a 1.1.1.1 WARP user. Non-Cloudflare sites will see Cloudflare's IP.
WARP isn't a traditional VPN service[0]:
> "From a technical perspective, WARP is a VPN. But it is designed for a very different audience than a traditional VPN. WARP is not designed to allow you to access geo-restricted content when you’re traveling. It will not hide your IP address from the websites you visit."
The entity delivering service to the abusive customer is profiting from that delivery. Terminating service to that customer hurts their bottom line. They have strong incentives to not only refuse all requests for help, but to resist even the most serious of requests, in order to protect their bottom line.
I’m sorry to rain on your parade - it’s nothing personal! I wish I could be more supportive! - but there is overwhelming evidence that every entity that is positioned to help will do whatever it takes to avoid helping.
If this remains unsolved, we’re going to end up losing anonymity on the Internet. Several online food delivery systems in the US already permanently block Cloudflare’s 1.1.1.1 VPN product by IP, using Cloudflare’s own CDN protection tools! Because it turns out that effective anonymity for all comers protects abusers from accountability.
That’s why this is a billion-dollar problem.