The Cloudflare bit, at least their consumer product in question only works as a public VPN (such as Mullvad, IVPN, etc…), meaning it’s more of an encrypted proxy. So it doesn’t counter anything.
Why it blocks incoming connections on other interfaces ¯⁠\⁠_⁠(⁠ツ⁠)⁠_⁠/⁠¯
It only makes sense for it to capture all outgoing connections not destined to split-tunneled IP ranges, as to prevent leaks.