consider everything that cloudflare has done with their position of power so far:
-protected nazis
-forwarded abuse claims to nazis for them to hunt the ones making the claims
-hatespeech? more like freeze peach. (Re: kiwi farms bullshit)
-DNS over HTTPS having no garuntees of privacy anywhere
-DoH being used for massive malware campaigns, and no commitments to actually hunt down malicious infrastructure
-cloudflare workers, tunnels and various other services often hosting malware, but then doing fuck-all about it because "Hey, we don't actually host malware"
So, would mishandling passwords really surpise anyone? but don't worry, "we're quirky because lava lamps, lol."