Just because they process the data doesn't mean they need to record it. I feel like a good analogy here is the ISP is your secretary. Sure they must have access to your documents to do their job, but if they're reading through your stuff for "gossip" or snapping photos of your documents, that'd still be an invasion of privacy.
(And even as we trust Cloudflare of 2019 doesn't do it, who's to say Cloudflare of 2021 will still live by this code? Can you guarantee that? I often find myself wishing for an established way for a company to make legally enforceable vows about its behavior. Maybe there is something like this already?)
I do not think most webmasters or web surfers know this.
see "Among other things, that resulted in us cooperating around monitoring potential hate sites on our network and notifying law enforcement when there was content" - and more, via: https://blog.cloudflare.com/terminating-service-for-8chan/