Even if the original idea (which btw, the origin story was shared on TechCrunch when they launched, was maybe even on their about page, etc.) was from this honeypot project, CloudFlare is a different beast. Moreover, there's now the company-wide "we'd all have to be in on it" perspective. If you read through the posts from folks like jgrahamc and others, you'd hopefully conclude that selling visitor data would be much less interesting than their actual business.
Here's the important thing about those FREE customers: many of them turn into high-paying customers later. For example, it is very common for CIO/CTO at $BIG_CORP to quietly test their personal blog on a Cloudflare FREE plan and we have no idea they are doing it. Later CIO/CTO uses that experience and decides to spend $BIG_DOLLAR from $BIG_CORP with Cloudflare.
From what I could find, it looks like they're still under 300 employees, and not everyone "would have to be in on it." Only the search team.
I know CDN services are meant to be fast and they try to minimize any type of slowdown, but many still keep logs and preform analytics. Also, employees often sign NDAs.
I don't know how CloudFlare SSL termination works, but I remember Akamai had SSL off-loading and they could, in theory, control payloads.
This author needs to provide direct evidence for some of the testable claims. Here are the cookie names, here is some of the Javascript and you can find the stuff here in the source code. Without that it's just conjecture, but it's still not outside of their capabilities.
I assume the MITM-SSL complaint is about their "Flexible SSL" which as they admit is not as good as SSL end-to-end but better than nothing.
Note: I have no affiliation with CloudFlare (I just dislike unsubstantiated attacks).