Cloudflare enables this because their stance is that they are a neutral carrier who is not responsible for the data they carry. If I send an abuse report to github for content on their system, there is a chance that I will be annoyed by how they handle it.

Cloudflare's core thing OTOH is to hide who I could be sending an abuse report to,

Possibly they will forward it ( more likely not) , but they will include my personal information in a report to an entity that is unknown to me, who are likely criminals, exposing me to danger.