Cloudflare. It's in the TOS. They're not a utility, so yes, they get to decide.
Their TOS gives them the lateral autonomy to decide what breaks the TOS, whether or not something violates their TOS, and how harsh of a punishment to enact.
Right, so what exactly is your point here? "Who gets to decide?" -- They do -- "Ok, that's what they decided".
We're all aware of who decided and what they decided. Decisions come with consequences, among them being criticized for your decision making.