It doesn't have the address exhaustion that caused providers to implement CGNAT, and dynamic IPv4 addresses.
No need for VPS management, DynDNS, port forwarding, hold punching. You still need public DNS, but you can use public DNS as your internal zone as well (no need for split DNS). You also still need PKI, so maybe setup a reverse proxy for SSL termination with a wildcard certificate.
When you mean incoming tunnel, it's no different from the many dynamic DNS solutions, where it's again up to you to integrate that. But even for this they have something:
RFC3053[0] seems to indicate this can be a problem as well:
> 3. Known limitations
This mechanism may not work if the user is using private IPv4
addresses behind a NAT box.
EDIT: According to HE's own FAQ[1]:
> If you are using a NAT (Network Address Translation) appliance, please make sure it allows and forwards IP protocol 41.
That doesn't sound like something most ISPs are likely to support. Not sure about home routers but if it has to be configured manually we're back to square one.
I mean I (probably) could, but don't want to, because now I have IPv4 via CGNAT, but not with a private IP, a public dynamic one probably shared with who knows how many others.
But I can use IPSEC/OpenVPN/Wireguard to somewhere else with that. Though my CPE supports GRE.
Anyways, there are large implementation differences in CGNAT from ISP to ISP and even different access technologies within the same.