He's not totally wrong. If the package is signed and the public key is trusted (the bigger 'if' actually) and the package signature passes - then it doesn't matter how it was transported. Even email is fine.

With that said, security needs to be in layers and defense in depth is critical, especially for this type of core infrastructure.

He should upgrade all infrastructure points for better security where feasible.

There's also the political reason not to use Cloudflare ... we're quickly moving to a darker Internet where traffic goes into networks like Cloudflare and nobody knows what happens inside the black box. I wonder if that's where the resistance lies.