While I agree there is a risk, I think a lot of their free customers would either not be using SSL at all, or else would find it too complex to remain independent and just have a Facebook page instead, if Cloudflare didn't make that kind of thing easier. Neither seems like it would be better. Not to mention things like being able to resist a DDOS from anyone who dislikes you.

Sure, there may be some people using Cloudflare free services who would otherwise be doing it themselves, but I think by far the greater majority of their non-paying users are folks too small and/or non-technical to maintain their own site otherwise.