Cloudflare DDos protection isn’t a silver bullet; the attacks are distributed and come from shifting source IPs, and are sophisticated in that they exploit resource intensive queries specifically designed to overload a Lemmy instance. If lemmy.world were to pivot to some other instance, who’s to say the culprits wouldn’t just resume their efforts pointed at the new location? There are theories these may be carried out by the recently-defederated fringe hate communities
I’ve gotta hop as well; I’m trying to find the biggest/most mainstream instance that hasn’t blocked or defederated from the piracy communities. Will have to check this list and find one when I get a chance.