Running a DNS server lets them know what site you're going to, just like everyone who sees the secured request also knows, right? Otherwise there'd be no way for the request to end up at the right location. I suppose they might have an advantage with an encrypted DNS, but I don't think it's much of a MITM if you're sending your request to them to find out where to go.
All US companies follow US law. It sounds goofy, I know, but it's a cultural thing.
When you operate at Cloudflare's scale, you receive a lot of inquiries from law enforcement in all countries. See also Google, Microsoft, Amazon, Apple, AT&T, Verizon, Linode, Hurricane Electric, et cetera ad inifinitum.
If your accusation is more specific than that, you'll want to rethink the word "arm" which is clearly incorrect and makes you sound like a loon.