I had quite a similar experience where our site (approx 10TB / month) was taken "off cloudflare" and all traffic routed direct to our servers at peak load (we were on the Pro plan @ $10/month after many months of free). They cited network issues in the control panel and a "Layer 7 attack" in a support ticket. We quickly upgraded to a Business plan ($200 / month) and traffic was back through cloudflare within 10 minutes.
Also, similarly to OP, we are regularly (fortnightly) automatically put in "I'm Under Attack" mode without any prior warning or consent which is quite annoying as it tends to happen overnight so I am not alerted until someone checks the live site in the morning (it still returns a 200 so current checks don't pick it up)
We use it mainly for the CDN, we have estimated a similar service using CloudFront would cost over $1500 / month (750% more - I acknowledge AWS is are not the cheapest)
Also, similarly to OP, we are regularly (fortnightly) automatically put in "I'm Under Attack" mode without any prior warning or consent which is quite annoying as it tends to happen overnight so I am not alerted until someone checks the live site in the morning (it still returns a 200 so current checks don't pick it up)