Thanks for raising this concern. You’re right about the risks of using the Global API Key. When we first released the add-on, it was the only suitable authentication method Cloudflare supported for the API operations the add-on needed to perform.
In the upcoming update next week, we will add support for API Tokens. We will mark the Global API Key as a legacy authentication method, but it will remain available for backward compatibility so existing setups keep working.