Yeah, about those I know, but what about cloudflare?

They hold your tls keys and can decrypt all your traffic. They're MITM as a serve, by definition. They have to be able to in order to cache appropriately.