But how does that work?

Does Cloudflare force firewall rules for those who choose to use it for their websites?

If the tool that does the crawling identifies itself properly, does Cloudflare block it even if users do not tell Cloudflare to block it?