Or snapped by Cloudflare themselves.
> Cloudflare may, at its discretion, elect to assume the registration and may hold it in its own account, delete it, or sell it to a third party. [1]
[1] https://www.cloudflare.com/domain-registration-agreement/
> In the event that Registrant fails to renew the domain name in a timely fashion, the registration will expire and Cloudflare may, at its discretion, elect to assume the registration and may hold it in its own account, delete it, or sell it to a third party.
I mention this because without that context it looks even worse.
If they alter the domain status to pendingdelete, as stated by the OP, the domain is de facto expired.
And the same Domain Registration Agreement gives them the unlimited right, at their sole discretion, to modify the registration of a domain for a number of reasons, for which it seems you have no other recourse than hoping to be on the frontpage of HN even if such decisions were unfounded.
I imagine those steps are something they hope to only ever invoke on clearly illegal enterprises.
They have some separate terms that allow similar things, in specified categories of abuse and related stuff.