> They can issue themselves a certificate for literally any domain, whether it is served by cloudflare or not.

They can but they're not allowed to, that's the entire point.