I believe this due to how CF handles file uploads. Turning off features won’t matter. For example, CF WAF would not inspect uploads outside of the headers. It does not inspect the body of the request. (Typically something like the first 15k of a file.)
Their enterprise plans have better handling for uploads such as streaming the request to origin, but I don’t believe those features are available on their free/business plans.