The entire tech aspect of online casinos is regulated, from procedure to register customers, to bonuses, to segmentation, to popups that you need to show during game, to responsible gaming features, to security controls in the infrastructure, to reporting etc. I worked for one and I took care of the compliance to licenses. Nothing is perfect, of course, but you are under tight scrutiny, especially when you start accumulating licenses.

I don't think casinos will throw out anybody ATM, they mostly work on quantity of users, they don't care of few individuals who win (in fact they are good business - they will most likely play again in the future). Actions are taken against specific segments of users that are deemed high risk (e.g. suspected sure-betters, syndicates etc.). There is no need to throw them out, usually limits are applied.

For cloudflare, still nobody explained to me how using features and bandwidth already available costed anything more for Cloudflare.