[ZWoz]

> It'll break

If you add additional piece to chain, chain becomes weaker, not stronger

> get AI-DoSed

Thats not that common. There are specific industries prone to DDoS, like gaming, but your average site don't get DDoS-ed. Then again CF free service really don't protect your site from DDoS. I have seen several times CF becoming source of DoS (not caching or denying malicious requests) and if back-end is on shared infra, CF goes to firewall.

> will have an expired cert.

Your back-end still needs certificate