You still need to run the cloudflared executable though. Cloudflare Tunnel currently proxies everything over HTTP/2 frames, but they've also started experimenting with QUIC[0]. This means everything runs in userspace. Main advantage here is it doesn't require admin privileges on the client and it doesn't mess with your network configuration.
If you use a VPN like OpenVPN or Tailscale (based on WireGuard), it will require admin in order to configure the network devices. The main advantage of WireGuard solutions is it runs in the kernel and can potentially be much faster, or at least more efficient. For tunneling often your upload throughput and not performance is the bottleneck.
