Regardless of whether or not you provide your own SSL certificates, cloudflare still uses their own between their servers and client browsers. So any SSL encrypted traffic is unencrypted at their end before being re-encrypted with your certificate. How can such an entity be trusted?
You don’t need to use CF tunnels to get DDoS protection and to hide your IP. If you are using CF tunnels without being undee a CG-NAT then you are getting MITM’d for nothing.
If you use CF for DNS and turn on the proxy, they still MITM you.
You have a very narrow view of why certain technologies should or should not be used. I’m not behind CG-NAT but there is still plenty of value to Cloudflare tunnels for me. Even behind my IP I have a fairly complex network environment but CF tunnels make it easy for me to stand up a connection from a cluster, make it resilient and highly available, and automatically handle failure modes to keep the service up to the world. They also give me a transferable configuration that allows me to quickly move my apps to the cloud or to other hosting if I need to.
So no, I’m not “mindlessly” using them, and I’m not using them just for security or just for DDoS protection. I’ve actually put quite a lot of thought into my architecture and why I used certain technologies, thank you very much.