Is it normal practice? Maybe 50/50. A lot of self holsters will tell you to use a cloudflare tunnel no matter what. It does help weed out a lot of bots. If you open a port and look at the access log in nginx, you will see thousands of attempts daily. It's basically bots constantly scanning the ipv4 range fishing for common vulnerabilies. I cloudflare will filter a lot of that out.

Personally I use cloudflare, but only for Lemmy. My other hosted applications don't use it, it's too complicated (and cloudflare can see your data). I use it for Lemmy to mask my ip address.

For plex, I would just allows Plex to open port 32400 and use their setup. Plus, cloudflare could ban you for streaming through their tunnel. It violated their TOS.