> anyone can bypass Cloudflare

How?

Plenty of ways to leak the original server IP address if it isn't really well hardened against that (and most aren't).