This is bullshit and untrue.

We contribute back our changes to open source all the time via https://cloudflare.github.io/. We upstream where people will take our changes. We directly pay open source developers (take a look at all the money we paid to Mike Pall for LuaJIT) and employ/employed people working on open source projects (e.g. OpenResty).

Over years we've been contributing and explaining how we operate and open sourcing the relevant code (just look at the series of blogs by Marek Majkowski and others talking about how we fight DDoS and open sourcing the tooling).

Dunno man, they release tremendous amounts of code, and pump huge resources into audits and other things which often go unaddressed in public projects. Aside from a moment of executive weakness a few years ago, they've been very principled and extremely generous.

I'm a bit concerned that they may become unprincipled and tyrannical once they are critical infrastructure, but that's a separate matter. Google is extremely generous as well, but as of late they are also disturbingly meddlesome.

Would it even matter if they use OSS software to speak an open protocol for OSS clients?

It's not like your freedom is being restricted by their software licensing, if it was going to hurt anyone it would be CF themselves.

Stealing OSS software is kind of an oxymoron.

While I think your conclusion is a little strong, it is fair to say they're trying their hardest to legitimize by becoming entangled into almost every possible piece of infrastructure around.

As far as giant databases in the sky are concerned, in my book Cloudflare joined the same category as Google a long time ago. I don't like them because they've become another data-aggregating SPOF anyone with sense should actively avoid depending on

Even if they don't contribute anything, I'm sure they comply with the license. The software author should've thought twice about the license they use. They will only be thieves if they don't comply with the license.

This could be either software authors mistaking non-copyleft for copyleft, or unrealistic expectations about how companies, and capitalism works.