You're right. I'm wrong.

Cloudflare continues to prove it's a shit service, too.

They're 100% right, substantively, about how they're satisfying their SOC2 control requirement here. I'd be alarmed and skeptical of any security practice that was led by compliance requirements.