Yes, that's true. I use Cloudflare on many of my sites, and they're basically ghost towns.
However, to my understanding, Cloudflare never requires that a site with a certain amount of traffic must upgrade to a certain tier. I believe there are many sites with lots of traffic volume that are still on their free tier. There are no bandwidth limits or charges at any tier.
That's right. CloudFlare doesn't have traffic limits.
But if a site gets a lot of traffic it's likely a business, and businesses have additional requirements. So, the paid plans become attractive (e.g. getting the WAF protection, or better DDoS protection, or mobile optimization, or SSL) and so people upgrade.
However, to my understanding, Cloudflare never requires that a site with a certain amount of traffic must upgrade to a certain tier. I believe there are many sites with lots of traffic volume that are still on their free tier. There are no bandwidth limits or charges at any tier.