(Cloudflare team here) cloudflared proxies the traffic through the Cloudflare network to the service behind Access so that Cloudflare can ensure the request is authenticated first and then issue a token to the client through cloudflared.
It's a bit like saying HTTPS isn't good enough, so let's tunnel HTTPS inside HTTPS -- unless I misunderstand its purpose.
Adding a public facing SSH interface to our production hosts was a bit of a non-starter and we would have had to hack together auth on top of that (not just for us, but for our customers too). That's a lot of additional surface area and operational burden we didn't want.
BTW we should catch up over a beer sometime =]