They are, but they don't have management for user accounts, 2fa, etc. You setup a connection to something like Okta, Google Apps, O365, SAML, etc to be your persistent user db and cloudflare just enforces it.

I wouldn't be surprised if they are working on first party IAM user support though.

We use our Zero Trust stuff extensively. In fact, we built it for ourselves initially.

There are good reasons not to dogfood critical services like that; it can make recovering from unexpected issues much harder if you introduce mutual dependencies.

For example, if Slack devops team were to exclusively communicate over Slack, then a Slack outage would be much harder to resolve because the team trying to fix it would be unable to communicate.

Did you read the article?

They are using zero trust and explained that it's why the scope of the security incident was extremely limited.