Inspired by Article 21 paragraph 2 of the Universal Declaration of Human Rights (UDHR):
“Everyone has the right of equal access to public service in his country.”
When a government puts their website inside Cloudflare’s walled garden, various demographics of people are excluded from access to a public resource. This manifestation of elitism violates people’s human rights because everyone is equally entitled to public service.
An unusually smart web admin can change the Cloudflare settings to allow Tor access, but this only fixes the denial of service for one of the marginalized groups and does nothing for the other groups being discriminated against (e.g. VPN users & people behind CGNAT). Cloudflare also harms the environment by encouraging websites to push heavy bandwidth-intensive content (videos and images) which wastes energy.
Therefore, new rule: government websites must be made reachable to all people who that government has an obligation to serve. This includes all public resources such as public schools and public libraries.
If they cannot handle the requirement for reasons like lack of funding or incompetence, they must take the website offline so all people in the target jurisdiction have the same level of access. If the web service gets attacked and suffers availability loss, that’s fair enough because all people are equally denied access and equality trumps the convenience of a few.
The reason for government usage of cloudflare has nothing to do with incompetence or lack of funding but rather department director egos and top down decisions.
Take for example a system where day care providers in a state submit invoices for childcare to receive payment. The law requires you to be in the State to provide care and to submit an invoice; in house filtering would require you to use an ISP that is available to someone living in the state (much more restrictive than cloudflare) but tor and VPN access make no sense as you literally are told these things up front when you register a daycare with that state.
The move to cloudflare made security worse but that is just an example of something which is an obligation to provide access and services don't even require VPN nor Tor user support.