The problem isn't "to date" the problem is what might be.

Sure, maybe the CloudFlare CEO seems like they "do the right thing" and then the administration gets pissed off at something CF related, they lean on the CF board and you've got a new CEO and maybe CF is sold off to "a friend of the show".

Nothing specific to CF here it's just how all US companies need to be viewed.

And what exactly stops this from happening to any company or organization, regardless of being US-based?

If 90% of customers are in the US, they're probably going to comply.