Forgive my ignorance - do Umbraco Cloud sites sit behind Cloudflare - I take it you don't get to customise rules etc but does it at least add basic protection on the website against "unusual" activity?

There are some settings, don't really know which ones though.. but indeed, not a lot I think. However, it is entirely possible to put your own Cloudflare in front of Umbraco Cloud's Cloudflare (inception!) so you can set everything you want.

https://docs.umbraco.com/umbraco-cloud/explore-umbraco-cloud/what-is-umbraco-cloud/frequently-asked-questions#can-cloudflare-be-used-with-umbraco-cloud The DNS Only configuration is the recommended approach for minimum custom Cloudflare maintenance. In the DNS Only configuration, the customers' Cloudflare zone won't apply DDoS protection or Web Application Firewall, and the Umbraco Cloud Cloudflare features will continue working. though not all that clear if it is cloudflare.. or just features that provide the same coverage...