No it's not. You don't have to like them, but malware is "any program or file built to damage, disrupt, or secretly gain access to a computer, phone, or network". Cloudflare is many things, some good, some bad, but they don't secretly gain access to your system, you have to choose to install it, so it's not malware.
>they don't secretly gain access to your system
They are only "enabling Web Analytics by default" "by providing a powerful, in-depth monitoring solution that helps you debug and optimize applications" when users do not come from the EU
Cloudflare is doing a great job most of the time, but I feel like this feature was speed run through approvals and could use more discussions
You choose to install it on your website if you own a website, but if you're surfing the world wide web, then a lot of the places you visit are increasingly being gatekept/hidden behind Cloudflare pages meant to "challenge" you if you take anti-fingerprinting measures.
Presumably these include any measures which would counter their operating model of tracking users on the web, under the excuse of stopping bots.