There are other providers of DDOS protection, and other WAFs.

The main advantage Cloudflare has is that it is free and a big brand.

Right. I was responding to the question "do you actually need DDOS protection?". Which is an obvious Yes in the real (non-hobby) world.