On the contrary, if you don’t have business in a country and they just spam you or try to hack you why not block the whole IP range. China, India, Russia, Subsaharan Africa, SEA
Moderation is when you block information from me, because I don't want to see that information.
Censorship is when you block information from me, because you don't want me to see that information.
Cloudflare is the former. Or at least, that's what they want to do. Or say that they want to do. If you let someone or something do moderation on your behalf, there's always a good deal of trust involved, that they're not manipulating you by also blocking information you would have wanted to see. Moderation is not a trivial matter. But it's also not censorship.
They block traffic reaching your website, not the other way around. For a poor, nitpickable analogy: they keep the bad guys out of your home, but they don't want to take away homes from the bad guys.
With your analogy, they aim to keep the "bad guys" out of all homes, which is the same thing as saying those guys can't have homes. Also the "bad guys" group you're referring to includes, like, my cousin Jake because he accidentally crashed his pushbike into a car once when he was 6, but doesn't include Adolf Hitler for some reason.
Isn't that exactly what Cloudflare is, in part? They happily block "malicious" traffic