Yeah, you can't have a public search endpoint or it will get spammed into oblivion. API endpoint is not cloudflared anymore though, since I use an API key system. But anything that is anonymous is basically toast if you don't use serious bot mitigation.

Cloudflare rejects about 2.5M search queries per day from bots. About ~20k make it through, and some of those are humans.