The term zero trust is bad marketing. You have to trust Cloudflare. The traffic is not end to end encrypted in their tunnel and access products (and pretty much all their products), and Cloudflare scans the traffic.