And all that while the company refuses to acknowledge that it is full backing.

Cloudflare loves to call back on the law when defending Kiwifarms, but then equate themselves to a public utility.

If the law intended for it, DDoS protection would be a public utility or at least a protected class of service that can't refuse customers. And if you say that it should be and the law is just lagging behind (and I'd tend to agree with you), I can say the same thing about the technical legality of a website that enabled and (indirectly) incentives doxing, harassment or even swatting (except on Kiwifarms, people might technically have a case for defamation, but good luck getting that prosecuted).