Interestingly they've chosen to just not offer 0RTT at all at the back end, at least for now.

I'm not actually sure if this helps. I guess it means 0RTT mitigation at Cloudflare concentrates the risk there - they can take full responsibility for doing a good job and if your clients have nasty RTT (e.g. satellite) you get most of the benefit with no work. Still, if you're very small 0RTT safety is easy whereas Cloudflare has to work very hard to even make it somewhat resist replays because their system is so distributed.