It isn’t clodflare’s job to take down or in any way take a stance on what websites they are providing most likely only DDOS and DNS services for.

That’s for example why privacy sites can use them.

It’s the police or maybe hosting provider that should decide when/if to take down sites.

If cloudflare were hosting the site I think they have more responsibility.