Earlier quoted context omitted.
Unfortunately we (Cloudflare) can't allow Host header rewrites like this as they could be used to bypass other customers' Cloudflare security settings. However, both of your examples can be done with Workers. I wrote a more detailed explanation a while back here: https://news.ycombinator.com/item?id=25058579
So it's okay for users savvy-enough to write Workers to bypass other customers' security settings - but not for self-serve point-and-click customers to do the same. Interesting. I suppose users of Workers are more likely to have a verified payment method and thus are less likely to be engaged in suspicious behavior. Thanks for the link.
What Workers does allow is for you to send a request to a different hostname. In this case, the Host header matches the DNS lookup. So if the third party is on Cloudflare, the request will go through their Cloudflare security settings.
It also allows, via the `resolveOverride` option, for you to do DNS lookup that doesn't match the Host header, as long as the Host header specifies a hostname within your domain. You can't forge a Host header specifying someone else's domain.