Thought it was strange that X got hit when they are using Cloudflare. Not much competence left at X I guess. What more have they done? No encryption between CF

Thought it was strange that X got hit when they are using Cloudflare. Not much competence left at X I guess. What more have they done? No encryption between CF and origins? The hackers can probably just launch a new attack from CF. Not like X is checking the headers if they failed with the basic setup.