> I'd be shocked if there's a mass-market CDN out there that has a unique IPv4 address per customer.

fortunately you only need to farm out the ones out that are under court orders

> They can absolutely block any site they want at the application layer (SNI or Host header or whatever they use, IDK, I'm a network guy).

these court orders usually work by getting end user ISPs (which are regulated) to block or reroute the IP and/or DNS entry

neither of which can be realistically done due to conscious decisions by cloudflare