It means "expire immediately" -- which causes the browser to revalidate. If the image hasn't changed, a 304 "not modified" is returned when the browser asks for it again. This is just what we expect when the plone.app.caching rule is set to weak (or moderate on the public side of a shared cache).
This is a typical rule for an image content item. It allows for the possibility that the image may have been changed without the URL having changed. Use strong caching if there is a reliable expectation that such content items never change.
Never use @@images/FIELDNAME/SCALENAME but use the API to get the scale UID-URL @@images/SCALEUID. Latter is a unique URL for the current upload. If you override an image, URL changes.
Then - given the caching profile is loaded correctly - the caching headers and whatsoever needed should be set right and Cloudflare is happy too.