Well, if your site is already running through Cloudflare, and uses a number of third party javascripts, the surveillance introduced by accessing said site over

Well, if your site is already running through Cloudflare, and uses a number of third party javascripts, the surveillance introduced by accessing said site over insecure wifi is probably not your biggest worry. The Googles, Facebooks and CDNs are known to capitalize that surveillance while your local pub might or might not. Describing that as a "limitation" of TLS feels like a bit of a stretch. TLS is not really designed to counter passive surveillance.