Your theory does not match the practice of Cloudflare. Whatever method is used by Cloudflare for detecting "threats" has nothing to do with consuming resources

Your theory does not match the practice of Cloudflare. Whatever method is used by Cloudflare for detecting "threats" has nothing to do with consuming resources on the "protected" servers. The so-called "threats" are identified in users that may make a few accesses per day to a site, transferring perhaps a few kilobytes of useful data on the viewed pages (besides whatever amount of stupid scripts the site designer has implemented). So certainly Cloudflare does not meter the consumed resources. Moreover, Cloudflare preemptively annoys any user who accesses for the first time a site, having never consumed any resources, perhaps based on irrational profiling based on the used browser and operating system, and geographical location.