The site owner can enable or disable that feature, so it's actually the owner you should be hating.
Or do you hate CloudFlare for offering such a (optional) feature?
I direct my hate towards those who make this necessary.
I’ve long taken Cloudflare to task for granting DDoS protection for countless DDoS-for-hire services, to no avail. I’ve maintained that Cloudflare has a blatant conflict of interest here, and that the DDoS-for-hire industry would quickly blast itself into oblivion because the proprietors of these attack services like nothing more than to turn their attack cannons on each other. Cloudflare has steadfastly maintained that picking and choosing who gets to use their network is a slippery slope that it will not venture toward.
https://krebsonsecurity.com/2016/10/spreading-the-ddos-disea...
Just a perspective from a user point of view, but I hate Cloudflare. All I remember about them is staring at their DDoS protection page for multiple seconds before a site's content loads.
EDIT: I'd argue that DDoS protection should be provided on the network level, not on the application level by some Javascript on a page. So yes I do hate Cloudflare for providing that service.