Flexible SSL is a measurable security improvement over no SSL at all. I'd argue that end ISPs are far more likely to tamper with or inspect packets than the tie

Flexible SSL is a measurable security improvement over no SSL at all. I'd argue that end ISPs are far more likely to tamper with or inspect packets than the tier 1 providers between CF and your infra. So, it's better than nothing. It doesn't make HTTP sites worse.