The analogy still works: Let's say the vending machine companies became fed up with being robbed all the time by people using face masks and as soon as somebody walked up wearing a face mask the vending machine would recognize this and turn into a locked down candy safe.
Maybe to get around this the vending machine could ask for an identity card to confirm this person was safe.
In the same way, could Cloudflare (or anybody else) cookie people who were deemed safe? Sure. But then that sort of defeats the purpose of Tor.
From the perspective of somebody operating these systems: they are either damned if they do, damned if they don't. Given the relatively small number of people using Tor, I think what has been done here is perfectly reasonable.
It's even worse: Tor protects only the source IP address, while leaving personally identifiable information like login, email, credit card numbers, browser configuration, screen resolution etc untouched.
An analogy? Being required to show you passport to use a vending machine.
