But that's just the day-to-day thing. There's also the DoS protection to think about. It's not just about organised black hat activity or botnets aimed at you, there's also the slashdot/reddit/HN effect to think about. All it takes is one user to think that something on your site is interesting (or worse, a hilarious error) and your site can be down for the count -- you can run over CPU or DB usage limits, run out of bandwidth (depending on your hosting plan) etc., and getting your site back online (if it's at all important to you) can put you out of pocket considerably. A service like Cloudflare can handle the viral for you (assuming you're not using header values that prevent it from doing so) and it can actively shut down anything that looks organised (which would include inadvertent DoS attacks as well, like CURL or WGET calls stuck in a loop).
But again, if you have next to nothing that sits still, few or no new users, and all of your major static assets are already being served by a CDN, then all you get is the DoS protection. It's up to you to decide whether or not the very slight performance penalty is worth it.