Other side of the problem: I've seen a vendor which moved their infrastructure to Cloudflare ask us to whitelist Cloudflare's entire set of IPs on our security platform.

They were politely told no. (Telling people no politely is a significant portion of IT operations, as it happens.)