I've seen it happen multiple times. Besides, "unmetered" is almost always marketing hype whenever you see it. If your website uses >10TB of non-DDoS traffic per day on CF you are likely to get a call from their sales team soon asking you to upgrade to a pro or business account.
A brief DDoS was (not sure if still is) a common method to expose the real IP because the CDN edge servers could often be easily spooked by a brief surge in traffic and start redirecting DNS back to origin. I suspect this is the kind of "protection" they were really offering: your site will still be down, but at least the backend is never revealed to the world.
They've publically stated that they do not drop traffic for any plans (at least as of 2017) no matter the size. So whatever you have seen is likely no longer the case. Unless you have sources that they are still doing this?
In earlier times they had to encourage people to move. By now, CF is so big that they can handle losing money on some customers with high traffic on a free plan. The gain from not dropping any customers outweighs the cost caused by that client.
A brief DDoS was (not sure if still is) a common method to expose the real IP because the CDN edge servers could often be easily spooked by a brief surge in traffic and start redirecting DNS back to origin. I suspect this is the kind of "protection" they were really offering: your site will still be down, but at least the backend is never revealed to the world.