There’s a default setting that allows unencrypted communication between the server and cloudflare. So they receive unencrypted data, sign with their certificate. Or send with self signed certificate, they decrypt and reencrypt. Or for some reason can download and import on the server their own internal use certificate.
I have wireless android auto and sometimes I wished it didn’t have it, for shorter trips I prefer to have no map, just the car radio, and for longer trips you have to plug the phone to charge anyway because navigation uses a massive amount of battery