No public server required at all

• CF: Yes

• frp: No

DDoS protection, WAF, and automatic SSL

• CF: Yes

• frp: No

Access controls and auth

• CF: built-in Zero Trust

• frp: manual setup of token/OIDC

Managed DNS

• CF: Yes

• frp: No

Built in security tools

• CF: Yes

• frp: No

---

Just like I said - prevalent reduction of valid arguments for usage of those services.