You only have to have them be your domain's name servers. Domains can stay at another registrar. This is pretty risk-free. They didn't even used to be a registrar until recently and they don't support registering all tlds so this always worked.
Cloudflare's business model appears to be wait till someone is generating lots of bandwidth and then give them 30 days to move up a tier or be closed down.
I've read reports of companies on the business plan being strong armed into signing Enterprise plans with 1 year upfront.
It's a listed company with revenue expectations, and VERY good at marketing itself, but it's free tier of CDN/DDOS to start off with is a good deal.