Source/writeup somewhere? The amount of domains that use CF must be staggering, so if this was a real threat being leveraged in the wild you'd think it would be an epidemic no??
Most websites don't use CAA records at all. The records can only narrow what CAs are acceptable down from the end user's root trust store, they can't add new CAs to it. And CloudFlare is typically in charge of managing its customers' certificates, so they add CAA records for their own CAs.
If you don't trust CF to manage your certs, you are not in their target market and generally should not use their products.
If you use CF as your registrar, they require you to use CF DNS. If you're okay with that, they register domains at cost. It's also easy to move a domain later if you change your mind and is quite fast. I recently moved a gTLD domain from CF to Porkbun and the transfer was complete in a matter of minutes, at the cost of a 1-year renewal.
