On the second point, with the introduction of Cloudflare WARP VPN, that's not quite true. Additionally, I believe Safari Private Relay may end up looking like it originates from CF as well.
Cloudflare reserves IP ranges just for Private Relay: https://developer.apple.com/support/prepare-your-network-for...