At a previous role we had our origin servers attacked by Cloudflare IP ranges even though we were locked down behind them. Seemed at the time anybody could spin up a CF worker and bypass origin restrictions.