I have an application that is protected by Cloudflare. The application responds with a HSTS on all of the other pages except HTTP status 403 Forbidden and 302 Moved Temporarily. It seems to be Cloudflare is responsible for it. There are also some resources (JS) that does not have the HSTS applied, but that is off-topic for this question.
My intuition says that all pages (and resources) needs to have HSTS because, while unlikely, someone mistyped the url and induced a forbidden it would be vulnerable to attacks like sslstrip.