If CloudFlare is compromised by an intelligence agency or forced by law enforcement and courts to cooperate, they're a large single-point-of-failure for privacy.
Less severely, they themselves know the vast majority of sites users are visiting and the content they're being served. Valuable stuff for advertisers, among others.
Additionally, a lot of sites probably just use CFs crypto, without securing it to their backend servers. Hence there could be less encryption overall.
Indeed, CloudFlare will happily run an HTTPS front-end proxy to an origin which is using a self-signed certificate, or even to a HTTP origin. Thought that site was secure? Think again!
If the origin used a self-signed cert, doesn't cloudflare use certificate pinning?