TFA explicitly says they're on the Pro plan, ie they're not a free customer. And good job spamming the same incorrect comment in the thread multiple times.
I address that - $200/mo is a lot more than the $20/mo a pro plan costs, which is why upgrading to Business might've been enough, depending on the traffic levels of the service in question. But if your service is pushing terabytes of images or billions of requests, you're costing CF a lot more than they're getting back (in both money and a stronger network presence). Pretty much every booru gets away with paying $200/mo to Cloudflare for pushing likely 20TB/day minimum with a lot of it cached (thus saving them on bandwidth costs to their main image hosting provider).
For it being allowed, the CEO commented as such here. I realise it's not the best reference but I'm not searching through ToS during lunch haha https://news.ycombinator.com/item?id=20791605
As for how to, something like this (Maybe don't use this specifically in production, it was cobbled together from examples as a proof of concept).
It may be missing caching, depending on if/how Cloudflare caches the output of Workers. It's been a moment since I've looked at this project but I'm pretty sure it was caching files that could be cached (using the etag bit on line 22).
E: Random thought you probably don't actually need to do this anymore, R2 has public bucket and custom domain settings now. I needed this for the CORS headers, as that was being a pita at the time