Who is “they”? You should do what fits your requirements.
There are no issues using Cloudflare proxying with websites managed by Virtualmin, but you do need to understand what it means. Virtualmin continues to manage Let’s Encrypt certs, but the Virtualmin server is not the termination point for secure connections for end users (Cloudflare is the TLS termination point, they control the cert for that, and thus see your traffic). You also can’t proxy to Virtualmin on port 10000 through Cloudflare. It is not one of their allowed ports. You need another name that isn’t proxied so you can reach Virtualmin on it, or you need to move Virtualmin/Webmin to a port that Cloudflare will proxy for.
Cloudflare pretty much only supports web services in its free version. You can’t proxy email, ssh, etc. so you have to have a name that isn’t proxied for those services, too.
There are benefits and costs. You’re somewhat protected from DDoS attacks for your sites being proxied through Cloudflare, as they block some recognized kinds of abuse traffic, and because they cache data that can be cached, it may reduce load on your servers during heavy load periods. It makes your dynamic pages potentially slower, as it adds a couple of hops. It can be harder to troubleshoot problems. You have a bit more complexity, as you need to understand the implications of all of this and configure your DNS and server appropriately for it. It’s also an additional point of failure, and it can be annoying for users as it sometimes pops up a “human” check, which adds significant latency and friction for users.
For the TLS cert, Cloudflare offers an origin cert that can be long-lasting, so renewals aren’t potentially broken by Cloudflare (I believe you can get Let’s Encrypt certs behind Cloudflare, but there have been problems with renewals through Cloudflare in the past, you should test, if using Let’s Encrypt, as you need the Cloudflare-to-server connection to also be encrypted). I don’t love that Cloudflare is now a man-in-the-middle attack on every connection to your server. You have to trust them with all passwords, etc. Any sensitive data going to your system also goes to Cloudflare systems first. If they’re exploited, you’re exploited. They probably have a better security team and stance than you do, but I don’t like handing over the keys to strangers.
It’s more work to use Cloudflare, the benefits are…mixed. But, many people like it. Many people feel safer using it. I use it for a handful of my sites where I specifically benefit from a feature that it has (Cloudflare pages for static web pages, for example, is a great deal…free hosting for static sites, with CDN, etc.).
