Do nameservers on Cpanel machines allow zone transfers by anyone by default?

Or are zone transfers just limited to the designated secondary nameservers?

Neither, by default cpanel installs bind 8-9, whose default for transfers is

allow-transfers {none;};

You have to manually edit /etc/named.conf to add slaves and they all have to have static ips.