Two CDNs with broken purge and an open origin is worse than one CDN you operate. Multi-CDN is for teams that already have a working edge and a specific second-path requirement.
Do the first CDN properly
Origin restriction, purge in CI, TLS, bypass rules and a rehearsal hostname. If that is not true, a second vendor duplicates confusion.
What a second path is for
Vendor failure domains, regional coverage gaps, or contractual dual-source. DNS (Cloud DNS weights or failover) is how clients choose a path.
Origin must allow every puller
Firewall rules that only allow one CDN will turn the second CDN into an outage. Token and logging stories multiply too.
Aptranet as one of the paths
Cloud CDN can be the only CDN or one path in a multi-CDN design. Origin Shield still helps on the Aptranet miss path.
