> but that means they are setting DNS records you didn't explicitly ask for
Sure, that's what you're paying them for. Cloudflare is not a "dumb" domain registrar, they are an integrated service.
> Getting a TLS certificate is pretty quick
Most of the time, yes. Sometimes there are outages or whatever. It makes sense to just get it done ASAP.
Distributing that TLS certificate to their edge network may take some time as well, and who knows what other internal prep they need to do.