A lot of people host websites created with a static site generator just fine without that extra layer. Unless your site has expensive to generate dynamic pages, lots of video content, or deep changelog pages (wiki history or forge commit diff’s publicly available), it makes a lot of sense to keep it simple.
Putting everything behind Cloudflare is just cargo cult behaviour and learning all the ins and outs of it isnt any harder than learning a firewall (which is transferrable knowledge that can also protect your machines from each other).
A law that specified you were actively using the phone would be hard to enforce. Simmiliar to how it is usually illegal to have open alcohol within reach of the driver. The officer doesn’t have to actually see you drinking it.