They kinda are. DDoS protection is only viable at massive scale, but is table stakes for any website with content that someone out there might find objectionable.
Please educate yourself on the law here. Most everyone in tech wants the internet to be a utility, but it's not. An individual internet company's product offering is definitely not a utility.
There are plenty of other companies out there that provide DDoS protection. If they can't find even one that will host them, perhaps they might want to consider the possibility that their content is reprehensible and there's a reason no one wants to do business with them.
If Cloudflare was the only game in town (or close to it), I might be more sympathetic to this argument, but... they're not. Not even close.
There are lots of providers with massive DDoS protection capacity specializing in hosting illegal or otherwise questionable content, they just charge more than cloudflare.
Botnet C&Cs, cybercrime forums and card shops all need hosting and face massive attacks. Somehow I never hear the operators of those complaining.
but DDoS protection is not speech - it more lets one shout in a loud room - as people keep reminding us you have a right to your speech, but no right to be heard
