I believe that creating a traffic rate-limiting system, which is more cost-effective than simply echoing back the requestor's IP address, is likely to be a complex task. However, I haven't personally performed the calculations to confirm this.

>Seeing that over 90% of my traffic load was malicious and abusive was frustrating. Dealing with the abuse emails and complaints was worse.

My take. I suspect Cloudflare benefited allowing that traffic. It's another data point/tool in their toolbox against the baddies.

OP said a fully saturated gigabit link, which generally means you pay for transit ("size of the pipe") rather than "stuff pushed through it." I haven't been in the market for a long time, but 5-10 years ago the price was on the order of $0.50 per mbps, so $500 for a 1000 gbps ("gigabit") link. Usually you buy this with a dedicated server or colocation. You wouldn't want to host this in the cloud because they price gouge you on bandwidth by charging for stuff through the pipe.

And that's if you truly expect to saturate it. If you just want to take the risk and go for oversold fiber, you can pay some nominal price for "unmetered bandwidth" (with the caveat that if you're saturating the pipe, your host will probably make you pay for it eventually).

That's ridiculous bandwidth pricing. you can get unmetered gigabit at Hetzner for €20 per month. Need 2 Gb? Order a second server.