I think the parent comment is referring to the "Flexible SSL" option where Cloudflare does HTTPS on the frontend but HTTP over the internet to the origin. Custo

I think the parent comment is referring to the "Flexible SSL" option where Cloudflare does HTTPS on the frontend but HTTP over the internet to the origin. Customers like it since they get the "green lock" in one click and no one can tell it's actually insecure. You could speculate Cloudflare are only analyzing this outbound unencrypted traffic, but they are of course seeing everything as you rightly pointed out.