Thanks for writing in for an educational opportunity.

First, for DDoS you don't have to use cloudflare, there are other alternatives for a CDN.  And you don't have to point the A-record of your domain to a CDN, you can use CDNs that are just third party images.  This makes it harder to ddos you but not impossible.  Solutions such as Bunny CDN accept anonymous bitcoin.

As far as IPFS goes, I don't think it will be popular because it has socialism built into it.  If one runs a pinning service, you're automatically serving up not just your customers' sites, but also random other people which raises the computer resources required.  Because IPFS has delivery separated from payments of filecoin, its unlikely people will subsidize the delivery.  However, I am optimistic about ArNS Arweave gateways.