I’m in the same boat, but I’ve pretty much decided to move my Restic backups to Hetzner Storage, unless something better comes along before I do the migration.

It does some UDP fuckery to bypass NAT and firewalls

I wouldn’t be surprised if they use hole punching. It’s an old but effective technique which Skype famously used back in its heyday.