> EasyList is hosted on Github and proxied with CloudFlare.

What is the reason for proxying through Cloudflare? Are there any bandwidth limits or performance issues when directly serving those files from GitHub?

GitHub has a soft limit of like 100 GB/month on transfers for Pages. According to the Adguard blog post traffic was already several TBs a day before the issue arose.

Why not only provide the list as a repo? You can't hotlink a repo. And someone abusing raw links is GitHub's bandwidth problem.

'Legitimate' users of the list would clone/pull the repo to their own mirror?

Do you mean like this? https://github.com/easylist/easylist

EasyList updates frequently, many times each day, as the commits to that repo demonstrate.