It’s your decision whether you want to have a /security.txt file hosted in your web server. If you don’t need or want it, there’s no problem.
As for DMARC, you seem to have already a record. Maybe check what your screenshot says so you know what the problem is supposed to be (click on “details”) .
In both cases, this has basically nothing to do with Cloudflare.