Based on the (recent) comment on the issue [0], they use the Cloudflare proxy instead of an actual CNAME /and use workers to do yarn-specific changes on the edge / (see below).
[0]: https://github.com/yarnpkg/yarn/issues/5885#issuecomment-392...
[0]: https://github.com/yarnpkg/yarn/issues/5885#issuecomment-392...