Several observations recorded in the Project Zero report about CF's response were problematic:
"I had a call with cloudflare, and explained that I was baffled why they were not sharing their notification with me."
"They gave several excuses that didn't make sense, then asked to speak to me on the phone to explain. They assured me it was on the way and they just needed my PGP key. I provided it to them, then heard no further response."
"I can already see that the (huge) list does not contain many pages that still have cached content from before the bug was fixed."
"Cloudflare did finally send me a draft. It contains an excellent postmortem, but severely downplays the risk to customers."
Granted, I have not been keeping up with what has changed at CF since then so maybe things are better. But the decisions taken wrt Workers doesn't inspire a lot of confidence. Even a Google Cloud engineer mentioned that Isolates probably aren't trustworthy enough to run untrusted code side-by-side https://news.ycombinator.com/item?id=18417257