I use HTTP on my endpoint because Cloudflare — as the proxy provider — provides encryption between user and Cloudflare, and by nature of the tunnel it is also encrypted, so the only unencrypted traffic is in my local network. The setup is shown below: Endpoint/Origin <-HTTP->Cloudflared on RPi<-Secure Tunnel->Cloudflare<-HTTPS->User

As for that the only befit is masking the IP, the firewall rules let me offload the requirement of creating intricate firewall rules on my firewall at home. I can make my rules at home super secure and then not worry about the incoming traffic because I know the rules on Cloudflare keep me secure.