You're vastly oversimplifying the problem here by only accounting for one class of problems. >". I would be willing to bet that outside of heavy-DDoS condition

You're vastly oversimplifying the problem here by only accounting for one class of problems. >". I would be willing to bet that outside of heavy-DDoS conditions that even a tiny fraction of Cloudflare's network could handle the incoming tcp connections and deny all of them." depends on the attack. >"You can send a tiny error page. You can let X% of requests get through and be fully served." Not usually that easy.