I think there may be a missing factor in their decision-making process. I'll quote the document itself: "We also believe that an Internet where cyberattacks are used to silence what's online is a broken Internet, no matter how much we may have empathy for the ends."
That seems correct to me. It is intuitively understandable how it applies to some people who want Kiwifarms to go away. It is, perhaps, less clear how it applies to Kiwifarms itself, so let's dig into that some.
First: if it's bad to use cyberattacks to silence what's said online, it's presumably also bad to use other forms of attack to silence what's said, online or otherwise.
Second: does Kiwifarms (or sites like instant-stresser.com, noted in another comment) overall have a silencing effect?
That's a hard determination to make! I actually wouldn't want to be in the business of making that decision. You need to have a clear public rubric and evaluation process, you should be very transparent about it, and you should be willing to defend your decisions and not allow your criteria to slip based on pure public opinion. I am heartened by their description of their ability to make that decision for the Daily Stormer and hold to their principles despite attempts to create slippage -- that tells me that, as an organization, Cloudflare is capable of making nuanced decisions.
However, we shouldn't avoid hard decisions just because they're hard, or even because we might make mistakes from time to time. We should do a real risk analysis, evaluate the effect of making mistakes, and compare that to the effect of not making decisions at all.
I'd encourage Cloudflare to go back and consider whether or not the principle of maximizing the ability to speak has implications about providing services to sites which are in the business of making fun of people -- sometimes lethally -- for things they say.