Yes this is true. If a site is not working and the only reasonable domain to allow is something from cloudflare, I resort to allowing it temporarily. Not many ways around that, I think.