Likely this is using the private network option that mobile carriers have been offering. Hologram has something similar where every SIM is in a private IP space

Likely this is using the private network option that mobile carriers have been offering. Hologram has something similar where every SIM is in a private IP space behind a NAT. Now it seems CF can run your phones in their own private LTE/5G network, anything going to work addresses gets split directly to those endpoints and "auth'd", while personal goes out to the internet. Similar to a VPN but without an endpoint and less spam traffic since it's a private network only your authorized SIMs can get onto. You could still run a VPN but all your Zero Trust should be over HTTPS/TLS and MitM becomes a bigger lift to make happen since you now have to attack cell sites.