Exactly. To the outside world, for all intents and purposes Cloudflare was their host. Cloudflare's IP addresses served 8chan's content, even held it on their local drives. I don't care (and neither should anyone else) that their primary source of truth was internally hosted elsewhere.
Cloudflare often tries to skirt definitions and would love to be seen as a neutral utility, a simple carrier. They're not though. 8chan was their customer. They hosted their DNS, served their content and potentially took their money (I don't know whether 8chan was on their free plan or not, but again that doesn't matter).
DDoSes are rarely prosecuted as the perpetrators are rarely caught. This is even more true when the DDoS is done by large groups of people (such as the scientology attacks a decade or so ago).
Further, 8chan is run in the Philippines, which would add a lot of complications to any prosecution