Do you remember what we said about governor limits for Process Builder?
The same considerations apply for flows as well.
DMLs (or update/create/delete actions) are done when we use Create/Update/Delete Records elements or Actions (such as quick actions to create a Chatter post), while SOQL queries are done when using, for example, the Get Records element.
One of the best coding practices is to bulkify coding, that is, avoiding repetitive SOQL queries or database operations one after the other and preferring to use a single database operation to commit more than one record at a time.
The cool thing about flows is that their engines are automatically bulkified, so if you make a Create Records element that executes after a massive record operation on the system (for example, massive data loading that triggers for each record of Process Builder that...