They most likely didn't actually 'turn on' RPKI, but just began filtering the test range that Cloudflare are using. This will allow them to pass Cloudflare's t

They most likely didn't actually 'turn on' RPKI, but just began filtering the test range that Cloudflare are using. This will allow them to pass Cloudflare's test page, without actually validating and rejecting invalid routes or even necessarily signing their own.