That sounds like cloudflare trying to reassure paranoid customers. I think its a reach to go from that statement to actual in the wild exploits.