If you're looking for an actual metaphor, it would be selling armed guard services to you and also to gangs. Its not even clear, in this metaphor, that said armed guard vendor can even tell the difference between law-abiding citizens and gangs - and they can't just shut down services to anyone accused of being a gang, because then the gangs get you by telling ARMED GUARDS, INC that you're a gang and then robbing you while you're not protected.
This metaphor got long and stupid, but at least its accurate. Stop fear-mongering just because you don't like CloudFlare.
You aren't getting it. The issue isn't that CloudFlare doesn't proactively seek out such sites. The issue is that when they are advised a site using their service is a DDoS service, and provided proof of that, _they don't care_ and continue providing service to it. The proper action would be to investigate the abuse complaint, try to conclusively determine if it is true and if so, terminate service to the site.
They don't do that, but continue to sell their DDoS protection service (beyond the free tier), so they are indeed a racketeering operation.
This metaphor got long and stupid, but at least its accurate. Stop fear-mongering just because you don't like CloudFlare.