Short answer:
Well, to a certain extent. I didn't mean to imply that their monthly spend for bandwidth is zero -- I'm sure they aren't anywhere close to peering 100% of their traffic, they aren't in the DFZ, and, of course, they've gotta pay somebody (or, more correctly, several somebodies) to connect all of those datacenters together!
---
Long answer:
About six years ago, they described their connectivity in "The Relative Cost of Bandwidth Around the World" [0]:
> "In CloudFlare's case, unlike Netflix, at this time, all our peering is currently "settlement free," meaning we don't pay for it. Therefore, the more we peer the less we pay for bandwidth."
> "Currently, we peer around 45% of our total traffic globally (depending on the time of day), across nearly 3,000 different peering sessions."
Remember, that was about six years ago. I wouldn't be surprised if both their peers and peering sessions have increased by an order of magnitude since that article was published -- just think of all the datacenters that they're in today that weren't back then, especially outside of North America!
Additionally, they've got an "open" policy when it comes to peering, as well as a presence damn near everywhere [1,2]. Since they're "mostly outbound", the eyeball networks will come to them, wanting to peer.
Running an anycast network and being "everywhere" also has some other benefits. They perform large-scale "traffic engineering" -- deciding which prefixes they advertise where, when, and to who, and the freedom to change that on the fly -- so they've got tremendous control over where traffic comes in to and, perhaps more importantly, exits from their network (bandwidth is ~15x more expensive in Africa, Australia and South America than North America, example).
So, yes, CloudFlare is still paying for transit but, at their level, it's relatively "dirt cheap". Plus, in addition to the increases mentioned above, bandwidth is likely an order of magnitude cheaper -- at least -- than it was six years ago!
---
EDIT:
Two years later, in August 2016, CloudFlare published an update [3] to the article linked above. A few highlights:
> "Since August 2014, we have tripled the number of our data centers from 28 to 86, with more to come."
> "CloudFlare has an “open peering” policy, and participates at nearly 150 internet exchanges, more than any other company."
> "... of the traffic that we are currently able to serve locally in Africa, we manage to peer about 90% ..."
> ".... we can peer 100% of our traffic in the Middle East ..."
> "Today, however, there are six expensive networks that are more than an order of magnitude more expensive than other bandwidth providers around the globe ... these six networks represent less than 6% of the traffic but nearly 50% of our bandwidth costs."
---
[0]: https://blog.cloudflare.com/the-relative-cost-of-bandwidth-a...
[1]: https://www.peeringdb.com/asn/13335
[2]: https://bgp.he.net/AS13335#_ix
[3]: https://blog.cloudflare.com/bandwidth-costs-around-the-world...