So far, I personally think most people would say they've been mostly benevolent.
But they are a public company, and a new CEO can have different priorities.
For example, (fairly or not) the public perception of Google has slowly been diminishing over time.
Any reality that becomes more adjacent in possibility-space today, is better conceived as the seed of a future you might find yourself living in. Most any protective institution is just a set of measures working against this process -- moving things away from us in possibility-space
So worrying about this stuff is fair game. The only way I'd not worry, is if there was a complementary protective measure that protected us from the future we don't want. But that wasn't part of the announcement, so we're probably all a little bit less secure in getting the world we want. (EDIT: Though maybe funding archive.org would count as that...?)
That reminds me a bit on how Google "funds" Mozilla. Not the same, but when dealing with the devil...
Or, to put that another way: if you can charge [infamous politician] a million dollars for a fancy-but-useless painting, you absolutely should do so. Now you have a million dollars; they're out a million dollars; and all they have is a painting!
Extracting money from bad sources is good as long as you absolutely positively don’t extract anything else. That’s hard to do in any circumstance. However, in this situation I think it’s fine and worth it.
Mozilla is a good case study in this: they are financially dependent on Google money to continue browser development. Google hasn't actually intervened in their affairs a whole lot. However, they could, which is why they're going through all sorts of self-inflicted harm trying to get away from their business of selling a browser default to a search engine.
Public companies are even worse, because what they are looking for isn't money, it's more money, or "growth". This is why a lot of American media companies suddenly got really quiet about certain kinds of atrocities committed by certain governments. If you call the devil out on concentration camps full of Uighurs, then maybe he doesn't buy your paintings anymore, and then you're out of the painting biz.
Basically, this is the other side of the coin to the idea that iterating the Prisoner’s Dilemma gets you the potential for tit-for-tat, and thereby cooperation under expectation of tit-for-tat. In this case, “defecting” against a devil is good — but, just like in the traditional Prisoner’s Dilemma, it’s only practical to defect if the scenario is one-shot.
They're denying access to no-JS users to many sites.
I'm just a happy Cloudflare customer.
On one hand, as a website operator, I want to prevent DDOS, spam etc... for my website. I can implement these solutions myself and do a bad job, or I can use Cloudflare that solves most of then. It's probably going to rule out some of the users as yourself - which is a shame. But until there's a better way to know that a visitor from the internet is not trying to attack the website, I'd have to use something like Cloudflare.
On the other hand, it's not like it's that hard to leave Cloudflare for me - so if there's a better alternative without causing legitimate users pain, I'd be happy to jump on board.
It's about cutting off access to a small segment of users just because it is easier that way.
I think that, similar to wheelchair access, we will continue to push for access to all devices and users as much as possible.
This attitude of "it's just 1%" or "it's just 0.1%" will become just as unacceptable as saying "well, there are only 3 people who need access ramps out of 30, so they need to suck it up and deal with it."
It's up to you which side you want to be on.
archive.org is exactly that. With rather poor performance no less.
And CF have access to decrypted SSL for many sites. Stuff like passwords, personal details, keys and tokens.