Errors from GraphQL behind Cloudflare are not delivered to browser

It seems you are right.

I’ve tried responding with some custom error pages myself, and some of them are served to the browser, while others are replaced by Cloudflare error pages.

500 and 501 worked, while 502, 520 and 522 were replaced.

According to this, 500, 501, 503, and 505 are untouched, and 502 and 504 Origin errors can be enabled on Enterprise plans.