edit* Apparently because I haven't used firewall-cmd in a long time, I was wrong on this: firewall-cmd does indeed use nftables by default.