That’s fine, and in principle I understand the threat, but I think there are plenty of security experts who choose to just use cloudflare because some of the services they provide genuinely require their scale and they have a pretty steady history of making very measured decisions about where they need to leverage their position to improve security.

There’s never been any indication that they’re collecting more than they need to or exploiting it beyond the scope of the service they provide, and several scenarios where they have refused to cooperate with governments trying to do invasive things. I absolutely think “moderately secure” still applies to traffic routed through cloudflare.