Exactly. My employer uses Akamai, which is larger than Cloudflare. Akamai provides the ability to block traffic from Tor, traffic from VPNs, traffic from any countries you desire, and so on. They also provide managed lists of countries listed in thing like ITAR so you can easily block them if you want.