* Cloudflare has a history of promising to open source projects only to not do so. For example, they built a system to shorten SSL certificate chains that they said they would open source but then didn't for over a year. When they finally did they admitted it was due to pressure from people on this site.
* Cloudflare got some initial fame by keeping Lulzsec up during a massive DDoS. That by itself wasn't bad, but afterwards they embraced a "bulletproof hosting" mindset that involved acting as a shield for malicious activity (specifically, people were abusing their network to host malware and drive by exploits). If you reported an account for pushing malware they'd block the single instance of malware (ie, example.com/malware/djfksdjf.jar) even if the original server was configured to serve it under any random name (example.com/malware/.jar). For awhile they were a huge source of infection for users.
Their CEO directly lied and accused a security company I worked for at the time of blocking their traffic to "suppress free speech", when what we were really trying to block were active drive by exploits. We sent a ton of evidence for this to them in advance- including PCAP files showing the exact network connection required. Instead of dealing with the malware they were hosting they started a PR campaign.
* After I criticized them before on this site several of their security team followed me on twitter for some reason. That's how I learned that they have a lot of "alt-right" type people on their team (or at least did at that time).