But is it stupidity or maliciousness?

I have a hard time thinking an anonymous VPN provider wouldnt know Google captchas and cloudflare are spyware. My field of expertise is rabbits and chickens and I know this.