Are you suggesting that CloudFlare is behind the same ddos attack that they're selling protection against? Because that's an absurd accusation.

Not the parent, but obviously if the cost of CloudFlare protection is $XXX million, a protection racket can say: pay us 10% of $XXX M to make this problem go away. It's routinely deployed against highly profitable online businesses like gambling, but I doubt even at a 90% discount (and assuming SourceHut were willing to pay off criminals, which I doubt), they are not likely to be a profitable target for extortion and some other motive must be at play.

Why is it absurd? Any such provider has something to gain by scaring us into believing we need their protection.

No, its more for the "fun" of making firms lose money, kinda LulzSec [0].

[0]: https://en.wikipedia.org/wiki/LulzSec