So yes it is a differentiated thing between wireguard and tinc, as you phrased it in your other comment.

tinc: One public node, thousands of private nodes, with NAT punching. That's fine and typical in my experience.