Especially when CloudFlare knows that their upstream is specifically targeting a certain class of users, they have a responsibility to fix this and notify their impacted customers.