Follow the SSL chain with CloudFlare and a certificate.
I really have no issue with any theme shop. They’re doing nothing worse than anyone else.
Why I WordPress, more thoughts on security, and also responsibility.
It’s for your own good that you can’t be logged in automatically to multiple domains.