They can just forward the encrypted bytes (I don't know if that's how they actually do it). Cloudflare does mitm decryption in order to inject its own code and captcha in the pages.