If you don’t know how to secure access points or harden configurations, no service will be able to do it for you as if by magic

That’s the point. Cloudflare does this as if by magic.

Not to mention your responsibility towards your users, who may not want to be tracked by a third-party company

Cloudflare doesn’t track your users.

As a sidenote - am I reading you correctly? Your main issue with Cloudflare is “they’re large”? Like, if they were “two dudes in a basement” and provided the same quality product as they do now, you’d be happy to use their service?