Out of your list, I would say that only load balancing would really make a difference, and only up to a certain point, depending on the number of hosts. It really takes time to introduce a meaningful DDOS prevention mechanism, as it may require both development and DevOps time to implement. Perhaps in the future, as Lemmy evolves, we will see less reliance on Cloudflare, but right now, we don't have many options. Lastly, you also have to consider the costs in terms of time and money.
Out of your list, I would say that only load balancing would really make a difference, and only up to a certain point, depending on the number of hosts. It really takes time to introduce a meaningful DDOS prevention mechanism, as it may require both development and DevOps time to implement. Perhaps in the future, as Lemmy evolves, we will see less reliance on Cloudflare, but right now, we don't have many options. Lastly, you also have to consider the costs in terms of time and money.