Am I misreading the architecture diagrams or is this going to be the largest MITM scenario in history?
Is this a huge security problem? Yes, it probably will be, some day. But it is what it is, they don't mislead users about the fact that traffic gets decrypted and re-encrypted.
(Aka CloudBleed https://en.m.wikipedia.org/wiki/Cloudbleed)
As a security company, anything less than "Full (Strict)" should not exist.
They also offer CloudflareD (Tunnels, formerly Argo), which connects origin directly to their network- so no chance of interception or Bypassing their services.
So, as long as it's set up correctly- theres no opportunity to MitM between Origin and Cloudflare.
Do people set it up correctly? I doubt it. I've seen several companies think they were using CF's WAF product, when all they really setup was DNS.