Even if it isn't true, it's not an unreasonable theory.

From what I could find, it looks like they're still under 300 employees, and not everyone "would have to be in on it." Only the search team.

I know CDN services are meant to be fast and they try to minimize any type of slowdown, but many still keep logs and preform analytics. Also, employees often sign NDAs.

I don't know how CloudFlare SSL termination works, but I remember Akamai had SSL off-loading and they could, in theory, control payloads.

This author needs to provide direct evidence for some of the testable claims. Here are the cookie names, here is some of the Javascript and you can find the stuff here in the source code. Without that it's just conjecture, but it's still not outside of their capabilities.