I'm pretty sure anyone who deploys aggressive cloudflare DDOS protection knows the impact and believes it's the lesser evil.
If there was just as effective a way to tell cheap bots from legitimate browsers without making users wait I'm pretty sure it would have been used.