Specifically, whitelisting the URL for the bot protection, but not the cache, so that you are still somewhat protected against adversarial use.
An adversary can easily send no-cache headers to bust the cache.
The CDN can choose whether to honor those. That hasn’t been an effective adversarial technique since the turn of the century.
does cloudflare give such an option? Even for non-paid accounts?
They ignore request cache control headers, I believe unconditionally so you’d have to disable caching for the endpoints which clients are allowed to request uncached.