The challenge being, who else could possibly handle Cloudflare's requirements? I imagine the next step is to build their own, and that's obviously not an easy pill to swallow.
They are using zero trust and explained that it's why the scope of the security incident was extremely limited.
I wouldn't be surprised if they are working on first party IAM user support though.
For example, if Slack devops team were to exclusively communicate over Slack, then a Slack outage would be much harder to resolve because the team trying to fix it would be unable to communicate.