You have to evaluate the type of account disclosure that was possible against your own use cases.

My company bills 1m a day through our online site, if my logins to our domain registrar were exposed then yes. .00001 is worth it, in the case someone would gain access and change our dns or do something else nefarious.

Like wise if my login to this site was disclosed, I can live with cleaning that up should it get out.

What shouldn't happen is the companies who were affected or the company who caused this (cloudflare) to say "no big deal"

At the very least they should say if you potentially used a serious service during this time and that service was using cloudflare then you might consider changing for reasons X,Y,Z.