Not a good idea to go through Cloudflare, which decrypt and cache the whole traffic, if we want to really improve our privacy..
I'm neither in favor of Cloudflare, but I'm not quite sure what's the problem if you're behind Tor-- besides of course the fact that it's a pain in the ass to complete the captcha (if any). I'm not an expert on this field, but isn't there a problem with DDoS-ing non-protected websites? I remember ChipMixer getting down for maintenance quite frequently in the past.
I think the problem is that everything you see they can also see. Basically, Cloudflare knows every step of your mixing process, and we all know that Cloudflare is a single email from handling all the data to a 3 letters agency (as we learned through ChipMixer, evidenced by the DoJ paper - P.S I'm just explaining what I read, don't sue me Mr DoJ, tyvm)