And that's diligence that Cloudflare would need to enforce on every single site they have?

This one is fairly obviously bad, but some will be more ambiguous, and I wouldn't expect Cloudflare to be the one policing them all.