

Cloudflare can’t be forced to censor anything because CDNs are not actually needed by the internet, they’re just nice to have. The only place where they could actually do anything is in the registrar business, where any foul play would just result in de-accreditation by ICANN.
AWS, Azure, and Oracle do have too much power over the internet, but that’s a different scenario.

You can’t get more legal than obtaining content directly from the rights holder. It’s more likely that the rights holder is leeching and recording the IP of the seeders.