> Cloudflare lets their customers write their own WAF regex rules right?

No, but customers can request a custom WAF rule to be written by Cloudflare engineers specifically for their domain.