They're not providing a regulated utility though and it's not like the harassment was occasional and dealt with on the customer end. At this point cloudflare is aware their customer basically exists to provide space for organising that kind of behaviour. And they know they're the provider of choice because they enable that service to exist. That's effectively the same as backing.

They helped prevent law enforcement being involved too https://twitter.com/stealthygeek/status/1485731108822077443 - they actually spent money on lawyers to protect that customer.

They're not legally forced to act here. They're just bad people for not doing it.