I certainly would not call that adequate, especially for someone like Cloudflare with their scale, and with what their customers expect.

What you describe may be technically possible in a very narrow sense, for only specific types of DDoS attacks, but I don't see it being practical in most cases, plus I think ECH would make this difficult to do properly.