Carabao? That too is often pronounced as "caribou." (Even I would call that a mispronunciation, for reasons to complicated to go into.)

Anyway, "cognate" terms don't have to share a pronunciation feature. Being "cognate" only means they're related by origin.

For example, English "maiden" and German "Maedchen" are cognate. They both descend from an earlier, now-extinct Teutonic word-form. But the "kh" sound that persisted in the German word fell out of use in English long ago. (And no one apparently wants to bring it back from the fifth century either.)

As for "cherub" (plural "cherubim): Greek, of course, had a "k" sound. So did Latin when the Romans adopted the word.

But Latin in the Middle Ages was pronounced differently all over Europe. In English-based Latin, the written "ch" was pronounced as in "church," regardless of the centuries-obsolete pronunciation of Classical Latin and Greek.

So anybody who says (or worse, insists that others say) "kerub/ kerubim" is a thousand years behind the times and, one might say, not really speaking English.