Because websites with almost no visitors are hit the hardest. A hundreds bots per minute hitting your server (if you host any kind of source code) versus one real visitor every other day is a great scenario to protect against.

The Russian government being stupid and evil isn't really Cloudflare's problem to solve. Neither is the lack of abuse prevention from VPN providers necessitating the extra challenges for VPN IP blocks. And, now that botnets are the norm, residential IP addresses too.

Obviously, Cloudflare's tools aren't the solution. The web needs to be closed down behind paid or real-identity accounts for websites to ditch these protections. It's only going to get worse from here.