> WireGuard uses UDP and a small handshake footprint, making detection and blocking via DPI harder.
Not quite true. Wireguard is already actively detected and suppressed if necessary. There's already a fork that employs basic changes to improve the protocol in this regard. AmneziaWG was shown to be more robust to detection for now.
https://docs.amnezia.org/documentation/amnezia-wg/
Too bad managing WG is such a pain and Tailscale/Netbird don't support this protocol yet. The following two issues need attention: