Is that because, even though a very small number of pages (they claim) triggered the bug, any adjacent traffic in memory could be disclosed?

That traffic could be basically anything sent through Cloudflare, it would seem.