the biggest part is they're doing way too much of the internet while being quite opaque. and their service is "too generous", with free tiers, no ads. and the whole MITMing every traffic and serving from CDN architecture seems ideal for a honeypot to me.
even if cloudflare themselves don't intend to be one, i'm pretty sure some three letter agency has backdoors to their systems.