I feel like Tor is burying their head in the sand here. I think Tor is great, but I don't find it at all surprising or unlikely that 94% of traffic (not users)

I feel like Tor is burying their head in the sand here. I think Tor is great, but I don't find it at all surprising or unlikely that 94% of traffic (not users) is malicious (spam, vulnerability scanning, scraping, etc) because it's likely that malicious traffic is automated while legitimate traffic is not. That said, I'd also like to hear more about CloudFlare's methodology.