The hash only takes the top 64 bits of the IPv6 address, so unless you have a wide choice of that half of the IPv6 address, you could only use the one you've been given by your ISP.
Even that possible vulnerability (if I can even call it that) would be stopped if they (Cloudflare) included a secret salt in the hash so the only way to know which class E a particular IPv6 address has would be to try it out and observe the connection from the other side.
Exactly. Since it looks like there's no salting going on, if you know your target's IPv6 (and from that their calculated class E), you could quite easily go through your own set of available addresses and see if any result in the same class E address as your target.
It wouldn't be a good assumption that the code we posted to the blog is exactly the same as the code that is actually in production. If we included something like a salt, we obviously wouldn't reveal it.
Even that possible vulnerability (if I can even call it that) would be stopped if they (Cloudflare) included a secret salt in the hash so the only way to know which class E a particular IPv6 address has would be to try it out and observe the connection from the other side.