"We've known it has an always-on microphone and speech-to-text for over a decade"

Literally? What is the reference here?

https://allaboutcookies.org/lg-smart-tvs-snooping

Yeah, about those I know, but what about cloudflare?

They hold your tls keys and can decrypt all your traffic. They're MITM as a service, by definition. They have to be able to in order to cache and forward appropriately.