You pay for the capacity of your network.
Cloudflare has huge ingress, because they need it to protect sites against DDOS.
They basically already pay for their R2 bandwidth ( = egress) because of that.
Additionally, with their SDN ( software defined networking) they can fine-tune some of the Data-Flow/bandwidth too.
That's how I understood it, fyi.
Some more info could be found when they started ( or co-founded, not sure) the bandwidth alliance.
Eg.
https://blog.cloudflare.com/aws-egregious-egress/
https://blog.cloudflare.com/bandwidth-alliance/