It's pendingdelete, so they're flat up holding it hostage until it's publicly available for anyone to register.
I wonder how many customers domains Cloudflare stole/deleted who’s owner didn’t have the luxury of knowing the Hacker News publicity trick?
I'm sure I could make decent money off punitive damages based off the email they sent, and these headlines would be pretty catchy -
"Tech giant siezed and deleted a customers domain name."
"Using Cloudflare can destroy your business overnight. This is how"
"Own a domain name? Your registrar can delete it without any recourse."
"Cloudflare siezed and deleted a customers' domain"
I'd need to check if I can use the word "illegally" in the title.
I hope they compensate OP. I'm sure they could still sue them if inclined..ICANN should have some rules about this.