IMHO, NCSC UK should use NoName to get budget for expanding Active Cyber Defence to include a managed WAF for councils (that can be expanded to other public services later).
Cloudflare don't do anything too fancy, just nginx proxies basically - the protection could be recreated without too much cost to shield orgs centrally and give assistance and intelligence on demand.