I’m not sure why you’re trying to bring that up when this comment of yours is what I’ve been responding to the entire time:

Nope. Cloudflare use a complex set of fingerprinting tools that determine security scores. It’s literally social credit system for web user agents and the site admits have little control over that.

Cloudflare does force nor opt in site admins to use the score. You said that site admins have little control over that. That is not true, because site admins do not have to use the score when configuring WAF. If they do not configure blocking based on score, they do not block the scored traffic at any point, no matter the score.