Best bet would be that something reloaded/changed the underlying ip/nftables bypassing ufw (ufw is just a frontend, I do not know if it periodically verifies the current rules are correct and it would feel extraneous to me if it did). Or it didn’t apply it correctly.
You can get the actual rules with iptables-save
(dunno about nftables command)
have it on dietpi (pi 4) + tailscale at home to monitor my dedics