> Regardless of Cloudflare, there is no way to know whether the traffic is encrypted between your apparent end-point and where it's actually used, nor whether that traffic is subsequently revealed to other parties, on purpose or by mistake.

Any server could be leaking plaintext data, sure, but Cloudflare offers and even promotes wrong-thing-as-a-service.