Yeah I never understood the decryption issue either. Even if you don't use them, Cloudflare offers a lot of services that do need to understand what the payload is. Its like complaining an AWS ELB needs to decrypt traffic to load balance.
I think you can do the same with NLB's. ALB's, however, have to terminate the HTTP so no choice there.