With this, 1.1.1.1, and the whole DNS over HTTPS thing; I'm thinking Cloudflare has something more... nefarious going on underneath.
I have no real reason to suspect it, but... a lot of what they are doing have large privacy concerns, as well as being centralized to the Cloudflare company.
It's the opposite of nefarious. We're trying to keep on with our mission of "help build a better internet" and that means provide as many secure options as possible. Hence DoH, this Tor hidden service, offering SSL for free to everyone, DNSSEC, ...
That makes privacy worse than the default setup with Tor since there's no stream isolation. With the standard Tor Browser you get a different circuit for each first-party domain, that's not something you'd have with this.