Yes, however I’d prefer not to go behind Cloudflare if I can avoid it, it is an option.
In addition to the benefits the Cloudflare proxy also adds some inflexibility that require a paid plan to make flexible again 
Also, my use-case requires a trivial feature that happens to require their Enterprise plan 
Either case also won’t necessarily help prevent billing overruns as you say. But I’ve read that Fly will waive billing overages related to attacks, for their own resources at least 
I’m starting to implement a billing cutoff solution for my app that I might also make available as a SaaS, if a good solution doesn’t already exist for that.