When someone says cloudflare is too good / cheap to be true... maybe think about it.
They have shareholders, who wouldn't allow them to provide value for free, its just not obvious to you how they are extracting that value. Maybe its by capturing a huge % of unencrypted https traffic because if you let them do your certs it means they can read all your real traffic.