That is not correct. Actually, the NS records for your domain are exactly the same ones you could add for a subdomain, just in the root zone. And even tho its not his intention, yes, this would work for clients too. For DNS, there is not really any difference between
example.org
test.example.example.org
as long as you set NS records. Only cloudflare blocks you from adding such a subdomain to their network. If you e.g. set NS records, you can host a subdomain with its own DNS entirely as you wish on dns.he.net (last time i checked they allowed domains not on the PSL).
DNS doesnt care about the PSL. Its mainly cloudflare that does, and webbrowsers.
The CNAME record you added only verifies that the domain is allowed to be added to byet hosting. However, you still need to setup DNS records.
In Cloudflare, create following records:
hosting.cheater.de A 185.27.134.175
www.hosting.cheater.de A 185.27.134.175
This IP might change in the future. You can always see the IP here: https://digwebinterface.com/?hostnames=hosting.cheeter.de&type=&short=on&useresolver=9.9.9.10&ns=self&nameservers=ns1.byet.org
That is also why its reccomended to set the NS records.