Cloudflare is explicitly a service for dropping requests, whether it’s DDoS attacks, as a WAF, or AI crawlers. It offers a lot more too, but this isn’t Cloudflare overstepping imo.

FWIW, I just set up a domain last week, and the web UI asked if I want to block AI crawlers or not.

Perhaps OP set it up agentically, and the agent didn’t pass an optional param correctly, or ticked the box for him?