They essentially have MITM capabilities over a significant portion of the web, undermining TLS security
Cloudflare is on them edge of your infrastructure. It's not in the middle of your service's infra and the user. It's not undermining TLS security because you are explicitly sharing the decrypted data with cloudflare to let them cache and protect your site.
>They have a tendency to deny access to normal users using privacy-friendly setups (Tor, without Javascript, etc)
To protect yourself against a bad actor you will need to fingerprint them and then imposes restrictions on them. People who are using privacy friendly setups look like they are trying not to be fingerprinted or have a shady fingerprint. By getting rid of a unique fingerprint that Cloudflare can learn to trust you end up always looking suspicious. Cloudflare did develop privacy pass to give these people a better experience when accessing websites protected by Cloudflare.
>and them operating in net loss (implying that the shareholders value growth, i.e. gobbling up even more of the internet infrastructure).
There are many competing CDNs. Most web traffic doesn't even use Cloudflare. There is still plenty of room for Cloudflare to grow.
>Some people are also concerned about their emerging ability as a powerful force for censorship and surveillance
This is a problem in general with internet service providers. ISPs can just decided not to peer with you or just null route your IPs. Cloudflare is less of a problem compared to major consumer facing ISPs.
>Cloudflare threatens the nature of the web as a somewhat decentralized system
So do DDoS attacks. If the small guy can't keep a site online like the big guys can that leads to a less decentralized web.