Can anyone explain why Cloudflare thinks it's their job to force CAPTCHAs or "Turnstile" on users? Why is bot traffic so bad for them? And in case it's about pr

Can anyone explain why Cloudflare thinks it's their job to force CAPTCHAs or "Turnstile" on users? Why is bot traffic so bad for them? And in case it's about preventing DDoS attacks, can't they wait for an actual attack until they activate the check for a site?