Yep – any legitimate tool that makes requests on behalf of a user could do so using Cloudflare workers. (A webpage translation service, for example.) It’s the same as any other provider. You could block based on the value of the CF-Worker header if you find it’s being abused.

I’ve built legit CORS proxies for web-based community tools using CF Workers when the first party doesn’t set CORS headers.