The reason for government usage of cloudflare has nothing to do with incompetence or lack of funding but rather department director egos and top down decisions.
Take for example a system where day care providers in a state submit invoices for childcare to receive payment. The law requires you to be in the State to provide care and to submit an invoice; in house filtering would require you to use an ISP that is available to someone living in the state (much more restrictive than cloudflare) but tor and VPN access make no sense as you literally are told these things up front when you register a daycare with that state.
The move to cloudflare made security worse but that is just an example of something which is an obligation to provide access and services don't even require VPN nor Tor user support.