I said MITM reading the client hello and using SNI sniffing. They are fully rewriting TCP flow not just what NAT does when they adjust the address and ports on

I said MITM reading the client hello and using SNI sniffing. They are fully rewriting TCP flow not just what NAT does when they adjust the address and ports on the packets. I'm not exactly sure the reason for this. It could just be a technical choice they made. But it does make it easier to flip a switch to do a full MITM that includes decryption using root certificates or using protocol attacks to decrypt traffic.