It’s scary that porkbun just gave away the domain like this. What if cloudflare was actually the threat actor? Could they just steal domains like this?

They should’ve not cooperated. Instead, cloudflare should have had to contact verisign - the actual owner of .com.