I checked two domains registered through Cloudflare about a week ago and both have 1-year certificates issued by Sectigo, valid until May 2025. Never enabled DDoS protection or any other features besides editing DNS records.