They're still decrypting on their nodes, and then re-encrypting before sending to the origin. There's no getting around the fact they can see the traffic as plain text.

And they leaked said decrypted traffic at one point...