Cloudflare has no problem classifying humans from developing countries as bots then inflating their statistics by blocking them. I know this is a fact because I personally get infinite block loops (captcha shows, complete captcha, captcha reloads) and many users especially from South and South East Asia for projects I consult for report similar problems. I know these are real humans because I have had voice calls with them, but according to cloudflare excluding people from some of the most populous countries on earth simply because of their geolocation IP address is stopping DDOS. At this point, DDOS has nothing to do with Botnets and is primarily about blocking people they view as undesirable. The cloudflare cto has been on hacker news before and agrees this is their policy and does not see a problem with it.

That said the op is wrong about vpn blocks, users able to afford a vpn with nodes in a first world country have no problems with access.