Sure. But if protection starts at $200/mo (CloudFlare Business) then it's not really for smaller sites with a controversial opinion. For $200 you can get two dedicated servers with DDoS protection on top.
2 dedicated servers might buy you ~3-4GB/s of DDoS protection. Cloudflair's base model protects from around 100GB/s, which what commonly takes banks offline (Bank of American, or Chase be taken down with ~70GB/s).
They gave talk at defcon21 about migrating a 300-400GB/s DDoS (Roughly 1.25% of all internet traffic in the US at the time was that DDoS).
When you start getting into DDoS's >300GB/s your DDoS will start causing issues for providers, and backbone companies, not just Cloudflair.