They absolutely should have outlined a traffic limit for the $250 a month plan. That's on Cloudflare for allowing it.
That said, if you make wildly excessive use of that loophole it probably shouldn't surprise you if they do something like this. They called it "trust and safety" because it allows them to do anything they want under the guide of security.
Really, they didn't define their service clearly and wanted to fire them as a customer unless they paid up for what they felt they were owed.