This is how I view it. Even if they were doing it maliciously, it is still a company and cloud flare should make the assumption they didn’t know they were doing anything wrong. Tell them it’s actually not allowed, that you just caught it, and give a clear (reasonable) timeline on getting to compliance.