Hackers and spammers have the ability to sign up for the same commercial VPNs as the rest of us. If they happen to launch DDOS attacks from the same servers that we use, I can understand why IP blocking is IB's (via Cloudflare) response.

ETA: On the commercial VPN that I use, only the biggest/fastest servers are on Cloudflare's hot list, and have been for ages. So. if I know I want to access FT (while also on VPN), I pick a server in a place like Santa Clara (i.e. not San Jose), that looks decent on the speed front, and roll with it.