> Cloudflare's ToS and contracts prevent them from doing nastiness with your data without breach ...
Contracts can be and regularly are changed. Ebay, PayPal, Etsy, Google, Microsoft, ad nauseum all have done this many times.
Contract-based protections mean very little if those clauses are non-perpetual and revokable.