That is a lot of wasted time for an already known and fixed bug. At the scale of cloudflare I would have expected them to have a few people intimately familiar

That is a lot of wasted time for an already known and fixed bug. At the scale of cloudflare I would have expected them to have a few people intimately familiar with their server hardware and in steady contact with their vendors, and to know and evaluate every firmware update for every component they use. At my scale, we install whatever is publicly available at a time of our convenience in hopeful trust the vendor knew what they were doing.