Cloudflare absolutely is in a position to take down domains they're hosting on those IPs while keeping other domains sharing the same IP up.
I think that's probably what they'll be doing in the end, so it's interesting to observe that they haven't done so already. Do they maybe have at least an internal domain reputation system so that long-time customers mostly share IPs with other long-time customers and are less likely to get caught in the crossfire?