True, but it still is a flaw with services like cloudflare and I don't believe their users know how many people actually get blocked. There are quite a few people that are familiar with these issues and it isn't only the technically affine.

Users of cloudflare-ish services (site owners) may see a joyful dashboard counter that expresses "we blocked 9000 nefarious attempts this month" instead.

Of course without the big fat asterisk of "actually, we have no idea what our false positive ratio is. So they could be 9000 prospective customers that we blocked."

And then the customer will think "oh wow good service, all those baddies blocked, better stay in the warm embrace of this service or who knows what will happen to my site".

This is being improved by CF - if you have any "managed challenge" firewall rules on the CF dashboard, which is 'browser detection and Captcha if potential bot', it will show a Captcha Solve Rate, so hopefully site owners will adjust their firewall rule settings till the CSR is under 10% or so.

https://rr.judge.sh/Screenshot%202023-05-30%20at%2011.19.52%...