It is true that ordinary Cloudflare only protects http and https from DDoS. For this reason, other services are configured to bypass Cloudflare and operate directly on your server. It seems trivial that if an attacker can find out the real IP of your web server they can just attack that, but that is beside the point.
Cloudflare offers a service called Cloudflare Spectrum:
Spectrum extends the power of Cloudflare to protect not just your web traffic, but your other TCP ports and protocols from layer 3 and 4 DDoS. By enabling TLS encryption, Spectrum reduces the ability for attackers to snoop and steal sensitive data.
Your origin infrastructure is exposed when delivering TCP services such as: custom gaming protocols, remote server access (SSH), secure file transfer services (SFTP), and email (SMTP).
Attackers can directly send volumetric DDoS traffic to those services, degrading web performance or bringing them down entirely. Attackers can also snoop unencrypted traffic on those ports to steal confidential data or credentials.
Obviously, we are not concerned if someone snoops our worker password provided it is different to our pool login (no-one has ever complained if someone starts mining on their worker) but, the ability to protect service using tcp other than http and https is valuable.
If you are legitimately concerned about the possibility of attack, ALL service should be masked to protect the identity of your actual server, nothing should be available directly and your server IP should never be exposed.
Now for the bad news:
To start using Spectrum, you'll need to be subscribed to a Cloudflare Enterprise plan.