That's a great question and it's worth pointing out the nuanced difference: the server here has no interface exposed to the public internet. No public IP addres

That's a great question and it's worth pointing out the nuanced difference: the server here has no interface exposed to the public internet. No public IP address, no hostname, etc. There's a whole class of security risks that are significantly reduced (e.g., mishandled credentials) by simply not allowing something to be directly accessible from the public internet (brief rant: I'm old enough to remember that putting databases on the internet was a bad idea, though lots of data platform providers are ok with that and now we're re-learning those lessons all over again). As for the comparisons to wireguard and similar: there are some similarities. The main difference is this is a virtual point-to-point TCP connection rather than a virtual IP network. It's designed to specifically connection two things and only two things. There are times when you want to connect two networks to each other, there are times where you only want to connect two things within those networks. Just a question of reaching for the appropriate tool for the job.