They are using Apple private relay; they are already trusting Cloudflare.

And that's the other thing - how can you be sure which parties you have to trust to use a service? We, tech people can sometimes figure it out. The normal consumer doesn't really have a chance.