It is probably just a question of price per unit. Adding a button would increase the cost drastically. If you want security, you just don’t go with a RFID tag. You go with a smartcard protected by a PIN. Security-minded people are not the market segment for RFID tags. And if people are forced to use a RFID tag in a security context, they can protect the tag with a shield.
Well, that’s not entirely wrong: the website owner is responsible for contracting with Cloudflare in the first place.