Isn’t it possible for Cloudflare customers to turn off the captcha, or at the very least prevent infinite captchas?

Yes, but I don't know which rules are responsible. It could be the bot management product but it could also be custom or default firewall rules. I think it's a combination of both. I don't know if the goal was to deliberately block certain exit points or if that was a side effect of some common settings meant to block bots or generic abuse.

It's not without reason. VPN providers are (by the nature of their business) home to all sorts of shady business. Sucks that some innocent people get hassle from it, but IP reputation systems are nothing if not damn effective at preventing abuse.