Comment by bawolff

The most likely answer is the person accidentally enabled the cloudflare reverse proxy without understanding what they were doing.

It seems incredibly unlikely cloudflare does this when just DNS hosting, if for no other reason then that this would break so many things.