A CDN caches (= stores) the bits they provide. In other words, they are hosting contents on others behalf. I can't speak to a legal distinction, but if you torrent child pornography, I'm pretty sure you aren't going far with a claim that you were "just a CDN".

My understanding was they were able to configure a simple page that was hosted by Cloudflare that was shown whenever the origin servers were not accessible. They put a joke about trans suicides on it.

Once that joke was pointed out on Twitter, it quickly disappeared. Probably because it was incredibly obviously against Cloudflare‘s policies and Cloudflare was the one hosting it.

Every byte that the end user sees came from Cloudflare's servers. Try making the case that that's not hosting in a court of law.