I think they have to for tunnels to work. They rewrite the headers so the target server doesn't have to have any special config to recognize abc.example.xyz as

I think they have to for tunnels to work. They rewrite the headers so the target server doesn't have to have any special config to recognize abc.example.xyz as being itself. I think in theory you could get it without it but that would be a lot more work on the recipient side. Me I'm less worried about that so I accept the convenience of not having to setup a reverse proxy and poke a hole in my router.