They also already have a source of DNS traffic to mine for new registrations. Surely a phishing site would show up there fairly soon after registration. So does being a registrar come with more benefits than just timing?
If it does, then shouldn’t the worry be more broadly about Cloudflare potentially abusing this system to deanonymize the owner of _any_ domain, not just those they deem trademark infringing?