But should a CDN service like Cloudflare protect against Brute Force Attacks...
TL;DR: Not should but could - but in case of Cloudflare there is actually such functionality.
A CDN is a content delivery network and not a content protection network. Some protection against DDoS is an added value Cloudflare and other CDN offer. But this is not core CDN functionality. Similar a CDN might provide protection against some brute force attacks but this is no core CDN functionality either.
Note that even if such feature is offered it will probably only cover common attacks and might not cover a specific attack flow possible against your application. And it might be a feature you have to explicitly enable and possible adjust to your specific application so that it will not accidentally block traffic you consider normal (i.e. false positives). In fact, Cloudflare already offers a Protect your Login feature for this purpose. And you could also add a more fine tuned rate limiting, see How do I use Rate Limiting to protect against brute-force attacks.