No cash outlay. Read the blog, but tl;dr is that it's quid pro quo as the owners can't afford to stand it up due to the volume of junk traffic (but want to, to study the junk) -- cloudflare can and will let the owner study the junk.

What cloudflare don't say in any of their materials that I've seen is the agreement is for an initial 5 years, so YMMV after that.