LOL. They are not.
Please educate yourself on the law here. Most everyone in tech wants the internet to be a utility, but it's not. An individual internet company's product offering is definitely not a utility.
If Cloudflare was the only game in town (or close to it), I might be more sympathetic to this argument, but... they're not. Not even close.
There are lots of providers with massive DDoS protection capacity specializing in hosting illegal or otherwise questionable content, they just charge more than cloudflare.
Botnet C&Cs, cybercrime forums and card shops all need hosting and face massive attacks. Somehow I never hear the operators of those complaining.