This is a good example of why text infrastructure should not automatically be treated as data plumbing. Transliteration rules look declarative, but once a rule system can keep rewriting its own output, you have to think about termination, resource limits, and adversarial input.
The practical takeaway for me is not "do not use transliteration rules." It is to run them with the same boring guardrails you would put around regexes supplied by someone else: bounded input, bounded output, max passes, timeout, and observability when a rule set hits the limit. Unicode bugs are often framed as correctness problems, but a lot of the production failures are availability problems caused by text that is valid, unusual, and much more expensive than expected.
The irony of a company that sells DDoS protection making the browsing experience worse for legitimate users. The real issue is that Cloudflare's bot detection runs JavaScript that introspects the page state — which means any site using Cloudflare is implicitly giving Cloudflare access to read the DOM of the protected application. That's a much bigger concern than the typing delay.