This is mentioned at https://developers.cloudflare.com/learning-paths/get-started/add-domain-to-cf/add-site under (3.):
Additionally, Cloudflare requires your apex domain to be one level below a valid TLD defined in the [Public Suffix List (PSL)].
This has come up as a reason for inclusion requests on the PSL, can somebody please provide further information on where this requirement on the CF side comes from?
Cloudflare limits many functions to n per zone (eg. DNS entries, Rules).
People would easily bypass this if they could sign up with subdomains, so partial setups and subdomain signup are restricted to business and enterprise customers, while free and pro customers are limited to zones that are one level below a public suffix.
Note that I don’t work for Cloudflare and this is just an educated guess.