Even in the old approach, you get publicly routable addresses over DHCP. The approval was for static addresses only, and was very fast, because you're literally

Even in the old approach, you get publicly routable addresses over DHCP. The approval was for static addresses only, and was very fast, because you're literally on the same network as the DHCP addresses. If they detect bad activity, they blacklist your MAC address so you can't connect. This is no different under the new scheme, and has nothing to do with NAT.