I don't get this. While it's cool that you don't charge based on bandwidth or TCP connections, it sounds like you basically do when that bandwidth is associated with an "attack".

Doesn't this make CloudFlare customers more vulnerable to attacks, since an attack will result in a monthly fine for the rest of the site's lifetime? (whereas a normal site just pays a one time cost)