Yes, I rarely see this being discussed. Cloudflare terminates the encryption, hopefully re-encrypts it on the way upstream, but they have access to all the content in the forwarded traffic. Not sure about the password managers, though. I believe most of them encrypt stuff on the device itself before sending it over the network, and there are no cleartext passwords transferred or stored on the servers.