You just need to make it "difficult enough". If the energy/processing costs of bypassing Cloudflare is high, then it doesn't scale up to a distributed domestic IP scrape of my million page website.