They are doing policing though, just the other way. Cloudflare successfully blocked taking the harassers to trial. Their lawyers blocked engagement of law enforcement against the right person in the first place.
Source please. They are still a US company, and must comply with all lawful requests.
+ context before/after in the thread. You'll find the link to the case documents there as well.
The FBI won't do its job, so cloudflare should do it for them?