I had the same problem and authing on the main page fixed it.

If they're going to block unauthed stylesheet requests, surely they could at least make sure that the CF authenticator shows up on every page.

Yeah, it's indeed broken because of cloudflare... I directly navigated to the stylesheet that wouldn't load (https://www.blender.org/wp-content/themes/bthree/style.css?x...) and got the cloudflare captcha thing. Now all the assets are loading for me.