You are seeing this because your User-Agent did not match the planted agent list. An agent User-Agent receives HTTP 403 from this same path while robots.txt permits all. This is a locally planted response, not a real Cloudflare WAF rule.