Good point. Yes, they are, as are all cloud services. But with AWS and Azure it's more explicit, in that the server is running on their machines.
With Cloudflare, you may not realize this if you don't know how HTTPS works.
The end game is not necessarily to avoid all use of cloud services, but to be aware of their functioning and their trade-offs, and avoid them where third party spying is crucial to prevent.
