Many CDNs still prefer you to use www or another subdomain, because apex domains don't play nice with DNS-based routing and the workarounds are either temperamental (CNAME flattening) or invasive (point the whole domain at the CDNs own magic nameservers).
DNS HTTPS records are supposed to fix that by enabling proper CNAME-like delegation at the apex, but they're not supported everywhere yet.