> one of the nice patterns of cloud hosting is how application and data servers are hosted behind firewalls of some kind

Oh I see, so that I benefit from the "professional" firewall of Cloudflare, as opposed to my own that I may have possibly misconfigured or forgot to update etc?

Or is there more, like Cloudflare will block IPs that know to come from malicious actors and things like this?