Does DNS entries for public hostnames needs the proxy enabled for Cloudflare tunnels?

I have set up Cloudflare tunnels, and from my understanding, my public IP won’t be exposed with this setup since the CNAME record points to Cloudflare tunnels. Hence, will it be necessary to enable the proxy status for the DNS entry ? What vulnerabilities can I be exposed to if the proxy status is disabled.