I assume malice in any company that doesn't test the basic functions of a page works. Someone made a resource decision the negatively affected the customer.
What gets tested and what doesn’t is an active choice which reveals malice, even if unintentional. A process important to Cloudflare will have the budget for testing; one important only to its customers, apparently not so much. Impersonal malice.
You think the choice of what to test is unintentional? It’s not that people actively prioritize harm, it’s that they actively prioritize not thinking about harm when it will hurt profits. The repeated pattern belies claims of ignorance.
All customers were receiving marketing emails.
Don't assume malice. Those things are rarely tested.