No one’s saying they are. But Cloudflare enjoys a virtual monopoly on affordable and reliable DDoS protection, and that is a very unhealthy thing for the open Internet. If you operate an online business and your comptetitors can somehow convince Cloudflare to drop you, they can have you taken offline, permanently, by paying a pittance to have you DDoS'ed.
I don’t think you can fairly call them a monopoly. It took me like three minutes to come up with seven different competitors offering DDoS protection. And that’s just top-of-mind companies, without even doing research into anyone I might not know offhand.
But how many of these will actually fend of a full-scale DDoS attack on your behalf without sending you a five- or six-digit bill for the trouble afterwards?
Haven’t researched all the options, but there must be some reason that DDoS targets all tend to use Cloudflare.