It doesn't seem that surprising. Just digging around in the passive DNS database at work, I see CloudFlare has their name servers in the NS records of several 10's of thousands of domains. I'm fairly sure that given the scope of the sources of this data, that list is nowhere near complete.