And because many website owners are just install and use Cloudflare with standard settings they don't care.
It's good that Cloudflare addresses this problem with their extension now but I had a little too much bad taste... this extension is long overdue and I still think it's not the best solution to the main problem (standard DNS settings too restricted).
If the like factories are using 3rd world IP's they are probably real human ( https://www.rt.com/viral/388169-smartphones-factory-generate... ) because bots can be run cheaper on a 1st world server because bandwidth, IP, and power usually cost less there. Captcha is an anti-bot measure and is not (or at least shouldn't be but I'm finding it hard to pass CF's captcha as human) very effective against actual humans.
I don't even think CF considers(or even aware of) the existence of a like factory on the same network for displaying the captcha and I am pretty sure they don't justify their captcha blocking with it. It's more likely that they just see a bunch of connections coming from the same IP and naively concludes that it must be a bot.
I'm sure it's easy to make "excuses"(vs justification) but given the real harm it does to actual human users and questionable effectiveness against the doubtful ill-effects of the existence of like factories against CF-hosted websites; I'd like to hear that "justification."
First world server IP ranges are treated just as poorly for this exact reason. Try browsing the web through a VPN/proxy on an OVH (French) server. I get captcha requests on Youtube videos and Google searches.
I mean, you could argue that it's not fair to discriminate entire countries because of the lax abuse policy of their ISPs, but the comment is correct: that's the reason those countries are discriminated against in this context.
When I was a sysadmin for a few admittedly-not-highly-popular websites, there were definitely more unwelcome bot traffic from US and EU IP's than there were from any 3rd world countries.
I also don't agree that social media "like-factories" should be a concern for Cloudflare at all. Even if they are truly a concern; social media "like-factories" are probably human-operated on third-world countries or bots that are likely running from developed world servers with access to cheaper bandwidth and IP's.
Browsing from a cafe, using VPN results in almost every attempt of following link from HackerNews in solving endless captchas. It is like being harrassed on the border control just because you have the wrong passport.
Saddly many of the sites "protected" by Cloudflare are interesting personal sites owned by honest people who had been scared about dangers of traffic from bad places.
Cloudflare is running internet protection racket Al Capone style.