Should cloudflare have taken down their servers to protect their clients? Which is worse, the leak live or the downtime?

The leak was live for a few months before it was discovered. Cloudflare quickly fixed it after they were notified.

The problem isn't the time between the discovery and the fix, but between the bug going live (I think around November 2016) and it being discovered in February. Nobody knows if it was exploited in that time.