I've never used Cloudflare so apologies for what is probably documented somewhere. Can the site owners not set JS requirements per-URL? I ask because the same JS hidden browser tests can be added to NGinx and HAProxy using LUA scripting and it can be done by ACL for specific URL's. e.g. No-JS for static content and URL's that use GET but then require passing the JS hidden browser test prior to using a page that would require a POST. That is just one example of the myriad of possibilities. Can that not be set up in CF? Or is it all-or-none?

For people not using a CDN and wanting to keep bots off the static content, this can for now be partially accomplished doing two things. Forcing HTTP/2.0 and one raw table iptables rule to drop TCP SYN packets that do not have an MSS in the desired range. Most poorly written bots do not even bother to set MSS. I'd wager this is something CF looks at in their eBPF logic. Blocking non HTTP/2.0 requests will drop all search engine crawlers except for Bing.