The sites I expose to Cloudflare were already being publicly hosted for my friends. Anything actually private or sensitive I run via private DNS and Wireguard internally.