In my experience, using a service like Cloudflare or Fastly creates a gap between what you're working with locally and in pre-production environments. It quickly becomes a single point of failure, but you can offset some of this with having a staging environment that mirrors production alongside e2e tests.

Admittedly, it's pretty hard to roll your own DDoS. If I was on bare metal or a service that doesn't provide its own DDoS protection, I would absolutely use something like Cloudflare despite all of the downsides.