Regarding Loomio, I think it's their decision how they want to host their flagship instance. Cloudflare has a lot of issues, and I would never use it for one of my own projects, but I don't blame them for outsourcing some infra to someone else.
It's really hard to work full time on a product while giving away its source as free software, and they have my support for doing so. Anyone who doesn't like Cloudflare can self-host because the dev team made that decision.