"Unfortunately, Cloudflare is pretty much the only reliable way to protect against bots."

With footnote:

"I don’t know if they have any good competition, but “Cloudflare” here refers to all similar bot protection services."

That's the crux. Cloudflare is the default, no one seems to bother to take the risk with a competitor for some reason. They seem to exist but when asked people can't even name them.

(For what it's worth I've been using AWS Cloudfront but I had to think a moment to remember its name.)