I'm directly replying to:

  Which is exactly what Cloudflare wants and has planned all along.

The idea that it's all planned and was a strategic bid to get into a stable business position and so on...

They've planned all along to mix bad hosting with good hosting to make any attempts to block them, legal or personal, cause plenty of collateral damage.

So to avoid this, how should they have done things differently?

Maybe they should have confined "bad" hosting to some IPs and disseminated this to countries directly?

P.S.: I'm not serious, of course.

RFC 3514 would be helpful here.

Ah, yes. That’s a much more elegant way.

This is literally the business model. The owner of an IP address is responsible for the content delivered from that IP address. Cloudflare would like to have it both ways -- they get to multiplex sites behind their network infrastructure and accept money for the service, but not be responsible for the content that they deliver, because it originally came from somewhere else.

> The owner of an IP address is responsible for the content delivered from that IP address

Nope, you are totally wrong; they are immune by US law.

AFAIK, CloudFlare removed only a handful of sites, but protected 100s - 1000s.

https://en.wikipedia.org/wiki/Section_230

In case the use of "literally" wasn't enough of a clue, this is incorrect. For the same reason that the DNS service, the ISP, or the internet itself are not responsible for the content.