In this case, the centralization is an advantage for privacy, depending on how you look. Basically, no one can guess who you are trying to connect to by looking

In this case, the centralization is an advantage for privacy, depending on how you look. Basically, no one can guess who you are trying to connect to by looking at the packets (modulo fingerprinting…). This is bad if you are a government, company, school or user that wants to inspect traffic coming out of black-box devices: it's harder to block all of Cloudflare. But this is good if you live in a country where service X is blocked because it threatens the local political power. For example, when Signal was blocked in some countries, it used a method named domain fronting to work around that. It relied on a mismatch between SNI and HTTP domains, and all CDNs blocked it in the end. ECH allows having the same result but with plausible deniability for the CDN. Now of course, there's always a catch… Cloudflare used to provide its services to kiwifarms; and what constitutes a legal, or moral thing to do tends to vary around the world.