The question I ask myself is: Why does it take sometimes a minute or two to 'Prove that I'm a human' when I'm secure/private... but only a second or two when I'm not secure/private?!? The argument that spammers etc. use TOR exit points doesn't rly cut the mustard when the only 'proof of human' they require is to move the mouse a bit and check the same box in the same location. If it walks like a duck and quacks like a duck... 

 Yeah I agree with you.  But their argument is that the more private you are, the less info they can get to see you're unique.  It's unique visitors that enable them to stop DDoS

They clearly put your freedom 2nd 

 There are other ways to stop DDOS. My solution is to close the tab whenever I see Cloudflare.