Yep, I was joking with our rep that them using Cloudflare Access for their internal services sounds like a problem waiting to happen.
Guess I wasn't wrong, they might even have lost access to internal monitoring systems which is pretty unfortunate in such a situation. If you ask them about Cloudflare Access they will happily tell you that it was built for internal tool access and that they use it for everything, later they went on to sell it as a product.