You don't actually need Redis - your site will generally work perfectly well without it. However, the point of Redis is to speed up responsiveness of the site by caching certain content and thus avoid database lookups and/or disk IO.
Cloudflare also provides some caching options with the ability to cache static content and serve it to end users from edge locations closer to their location - thus reducing latency and increasing perceived performance. Again, it is not necessary, but it does help the site feel faster to end users.
I do think that Cloudflare threat mitigation is the most important thing here though - both reducing the chance of DDOS attacks impacting on your site, but more importantly - giving you more control over bot traffic, especially malicious and badly behaved bots, but also AI bots scraping your site without your content. It also makes it easy to identify specific issues or attack vectors and block them via the firewall facility.
It's not strictly necessary - your site can function quite well without it - but I think your overall site performance, security and reliability will improve by using it.
I'd say that Cloudflare today is more useful than ever before - bot traffic is increasing significantly, especially with the growth in AI bots - and that is creating a lot of unnecessary extra load on servers.
In summary: neither are strictly necessary, but both serve a useful purpose and personally, I do use both of them with all of my XenForo sites.
