Exactly this! I think I've said it a few times already, but: if it were a case of a government telling Cloudflare what their policy should be, I would absolutely be right there defending their right to make their own policy decisions without governmental interference. This isn't that case, though. This is us (and, we hope, others) deciding that we no longer want to do business with a company whose answer to the complicated, unanswerable questions of content moderation is ¯\_(ツ)_/¯ instead of engaging with any of the impossible balancing tests and compromises any service has to wrestle with regularly. Content policy and content moderation is an impossible set of hard choices, and I absolutely sympathize with their desire to try to chuck all those choices out the window instead of wrestling with them. (And to be fair, sometimes I'd love to be able to do the same.) But providers do have the responsibility to at least try to answer those questions for themselves, and we think providers in the "as permissive as possible" space have a greater responsibility to work through those questions and try to find answers that balance the "as permissive as possible" against "without causing people severe offline harm".

Cloudflare is absolutely free to set their content policies and AUPs any way they'd like, even "we will never remove a customer from our security product for any reason". We aren't doing this to pressure them to change their policies; they probably won't ever notice we left, and that's fine. We simply prefer to direct our money to vendors who more closely match our principles.