I don't think it is explicitly against the ToS any longer, although it used to be from what I can gather. There is no longer a section 2.8 here but it does state in section 2.7:
You agree not to...(b) post, transmit, store or link to any files, materials, data, text, audio, video, images or other content that infringe on any person’s intellectual property rights or that are otherwise unlawful
So as long as you either only host original content or your media server requires login and is not open to the public then I don't think you'd have any issues.
I actually use a Cloudflare Tunnel in this way to serve a Jellyfin docker container and have not had any issues. I also disabled Cloudflare caching though for the subdomain that Jellyfin is served from, in order to be sure Cloudflare wasn't caching that media either.
This is exactly the video that first got me started on the channel as well. It randomly came up in my YouTube feed and I let it play... then have since watched dozens of these fascinating, boring, videos.