It looks like it scans and flags on the outbound (user download of the image), so as long as it sits in front of your instance, it should work just fine.
You’re still responsible for removing the material, complying with any preservation requirements, and any other legal obligations, and notifying CloudFlare that it’s been removed.
It would be ideal if it could block on upload, so the material never makes it to your instance, but that would likely be something else like integration with PhotoDNA or something similar.
Lemmy.world had to start using CloudFlare because some script kiddies were DDOSing it. Some people were complaining that it encourages centralization, etc.
Personally, I love it. The service you get even at the lowest level of payment ($20/mo) is great. And what you get for free can’t be compared.