There are different levels of DDoS. A shared server doesn’t take much to overload, so a small DDoS from just a handful of IP addresses can shut it down. Heck, even getting “slashdotted” could even appear as a DDoS.
Cloudflare’s standard DDoS protection kicks in for major attacks.
If you want to defend against a minor attack, you’d have to try using “Under Attack Mode”.