They do this already. See their blog post. You can explicitly whitelist Tor IPs, I thought it was plan limited to only enterprise, but it seems it's available to all actually.

It's a fundamental problem with IP-based reputation. Same goes for VPNs where there isn't a specific list of hosts you can whitelist.

IP based reputation has served us well, but it's no longer relevant. IPv4 has reached exhaustion, carrier-grade NAT is being deployed and the idea that an IP address correlates with one person or a very small group of people no longer holds. You can sort of pretend it does if you only serve america and europe, but that will change too.

Any company that currently bases their offering on IP-based reputation better be working on different solutions to the problem or they're not going to stay relevant for long. This is an existential issue for CDNs.