I can't believe that this thread is out here since 2018 and shopify still has done nothing! I have other sites on cloudflare so I guess I'll just put the shopify site on there too the only thing I don't like is that cloudflare then only reports their ip addresses and not the original visitors ip to your traffic logs etc. So you'll see everything coming from them whether it's rogue (and they let it through) or not. Have you found a way around that?
Many reputable companies use cloudflare not just bots and spammers. I did block cloudflare for a few days and found it problematic as some Shopify apps or the developers/ website use CloudFlare. So instead I now reverse search the IP address to determine which website owns it and if it's an ongoing problem, I block that IP.