*.example.com won't match foo.bar.example.com. 

That's a technical limitation of the way name matching works (similar to DNS); not a CloudFlare restriction.

Our free Universal SSL certificate includes a wildcard (so if you sign up example.com you get *.example.com).

Annoyingly, TLS wildcards have very a different meaning to DNS wildcards.

DNS wildcards only work when * is the leftmost label of a domain name, so

    *.example.com is a wildcard
    foo.*.example.com is not a wildcard
    *bar.example.com is not a wildcard

A DNS wildcard matches any non-zero number of labels, so

    *.example.com
    foo.example.com matches
    foo.bar.example.com matches
    example.com does not match

RFC 4592 describes DNS wildcards.

Unlike the DNS, the * in a TLS certificate can only match one label, so

    *.example.com
    foo.example.com matches
    foo.bar.example.com does NOT match
    example.com does not match

RFC 2818 also allows the * to appear within a domain name, not just as the leftmost label, and wildcards work even when they are part of a label. One of its examples says

    f*.com
    foo.com matches
    bar.com does not match

But nowadays sub-label wildcards like this are not supported.

Right, but even in paid plans, there's no ability to get further subdomains. Just pointing that out and wondering why. Technical issue that isn't worth the effort?