I am an avid Cloudflare user who of course maintains an exit strategy in case I need to stop using their service for any reason. On the web, this isn't a big deal - I can switch DNS and reconfigure my web server with relative ease, and others can do likewise. Web servers tend to be maintained by people who know what they're doing.

What is the exit strategy for a Cloudflare Orbit-using vendor? If said vendor has shipped a million IoT devices which all answer only to Cloudflare-proxied requests, what do I do if Cloudflare suddenly ceases operations one day? These devices aren't likely to all be in the hands of technical end users. Even with a short notice, it could be difficult to update all the devices in time.

Of course the vendor themselves may be far more likely to go out of business than Cloudflare, but in such a case there won't be any further device updates to worry about. This on the other hand adds yet another point of failure in to the mix.

I can't help but feel that if I was a vendor with a bit of extra money to throw at security, I should throw it at ensuring better practices on my end rather than a service.