Nope. Just because Cloudflare has a ton of bandwidth doesn't mean the origin web server does. An attacker who wants to hurt an origin server just needs to find

Nope. Just because Cloudflare has a ton of bandwidth doesn't mean the origin web server does. An attacker who wants to hurt an origin server just needs to find a URI that Cloudflare doesn't cache (and that's very often /; think of any site that's dynamically generated by some CMS as an example). So, if you let traffic through to an origin without running any security it's trivial for an attacker to knock off a web server. Thus Cloudflare has to take different security measures to protect servers. And we do see L7 DoS capable of knocking origin servers down via Tor.