They don't give the IPSec parameters. Wireguard uses ChaCha20 for encryption with Poly1305 for authentication. IPSec can use many different combinations of cipher and authentication algorithms. If they were using AES+SHA256 then SHA256 would likely be the bottleneck. AFAIU, Ubiquiti routers use a crypto coprocessor (as opposed to AES-NI and SHA-NI on amd64), which means even if SHA256 was accelerated on the coprocessor it could easily still be too costly. But we don't even know if the MAC was accelerated at all. The implication that "IPSec acceleration" handicaps Wireguard is unfounded.

If those benchmarks were with AES+GCM, then that would definitely be surprising. But the safe bet is that they were using AES+SHA256 (or something other than GCM for the MAC), in which case their benchmarks are not surprising, simply misleading.

IPSec can also do ChaCha20+Poly1305 (at least, OpenBSD's stack can). Any serious comparison should also include IPSec using the same crypto algorithms as Wireguard.

I’d love to see benchmarks on an ER-4/6/8, especially with gigabit WAN availability becoming more common.

Note that hardware offload only really matters when you're combining fast networks with slow processors. WireGuard on a modern PC CPU will more than saturate gigabit ethernet and the per-packet latency hit is <1ms.

Well for some of their routers its false advertising. On the edgerouter x ipsec offload for client vpn have been broken for more than a year.