Some people think they're providing value. They do block some bot traffic (at the cost of many many false positives) and I'll bet that they're providing endless amounts of data to one or more three letter agencies. They also provide lots of value to scammers who use cloudflare to protect their phishing and malware pushing webpages from automated systems that would detect/report them while also making sure visitors have JS enabled so their browser exploits work.