Not really. It's more like Cloudflare is providing an ipset in your iptables config. It's not Cloudflare's decision: they're just making it easier for you to do it.