They have a product called Magic Transit that offers DDoS protection and such for plain IP traffic, where Cloudflare does not terminate TLS. Pricing is not public but starts in the five-digit USD per month range according to people I talk to.

This may tell you something about how keen Cloudflare are to handle traffic they themselves cannot decrypt.