I've heard people bring up that problem before. On one hand they protect sites from DDOS attacks and bad actors, but on the other hand they help keep the bad actors online.

If there's no abuse, nobody will pay their protection money.