This isn't specific to Cloudflare. Many (most?) services only terminate TLS on their client facing servers and any request/response is in the clear to any backend servers (which might be located on other networks).

Regarding CF, traffic to an origin server that's set as flexible might still go through a secured tunnel (e.g. Argo).