I'm hoping that with the coming of IPv6 many of these issues are going to go away. At that point Cloudflare could give every customer their own /128 that is static across the world (they route their /64 or /48 however they please using anycast) and forward traffic as they have always done with caching.

Then it becomes trivial to block a single IP, since it is assigned to a single customer you won't have any collateral damage!