They provide DDoS protection to DDoS providers that would otherwise have taken each other down, so those providers can find clients for their services which further necessitates Cloudflare’s main product.
DDoS providers have websites marketing their services which Cloudflare allows (for free!) in the name of not policing speech. Before Cloudflare, they didn't exist because competitors would always take each other down. Anyone who wanted to hire them had to go trawling the darkweb/freenet/random hacker forums.
They provide DDoS protection to DDoS providers that would otherwise have taken each other down, so those providers can find clients for their services which further necessitates Cloudflare’s main product.