this exact problem is mentioned further down in the cloudflare article: https://blog.cloudflare.com/validating-leaked-passwords-with...

according to that sharing a part of the hash is a risk. it could for example end up in logged urls somewhere. it's a pity that the argument revolves around absolutes ("this is bad", "no, it's not") instead of actually investigating and explaining why they see a problem here.