ToS are a contracted. You can specify a legal venue as part of a contract (though that’s not always enforceable, especially in B2C relationships).

However in this case, Universal sued them without being a customer (or, if they are a customer, in a matter unrelated to their customer/vendor relationship). You can’t pick the venue where people/organizations that don’t have a contract with you sue you.

Of course, the other question is then how to enforce the court order. Since Cloudflare has a German subsidiary, that won’t be a problem.

Note also that the effect of this ruling is limited to the territory of Germany. Cloudflare doesn’t have to block this website anywhere else.