For one, the idea of "delegate security to a central authority because they know what they are doing" is one that has failed so catastrophically in history it's surprising anyone still considers it a convincing argument. If there is one thing humanity should have learned, it's that centralizion of power is itself a major security problem. Electing dictators to solve security problems does not work.
Then, "we have to give all power to cloudflare or we are on our own" is obviously a false dichotomy. No, people can work together on fixing security problems without the need to delegate power to a central authority.
Also, it isn't hard to keep "a modern system" secure. It's just that noone cares, in part because they think they can just buy security as a product that they somehow plug into their system to make it secure. But that is just a completely mistaken approach. You can buy "IT security" as much as you can buy "car safety". If the engineering of your car is shoddy, no add-on will make if safe, and it's exactly the same for IT systems--and if the engineering is solid, there is no need for "safety add-ons".
BTW, one particular kind of "security" that large organizations are good at is controlling PR. It's just that that is not in your interest as their customer. It's just one of many conflicts of interest.