spacemagic

I'm assuming they have DDoS protection by default, being a Cloudflare product? Or is the reasoning simply that they allow you to set a bandwidth/usage cap?

That makes sense, but is the Netlify subdomain visible from your custom domain? How would they be able to figure it out, other than humans leaking it somehow?