Under CFR, who bears the risk during ocean transit?

The buyer does. Under CFR the seller pays the freight to destination but risk transfers when the goods are on board at the port of shipment. This split between cost and risk is the most misunderstood feature of the C-rules.