When it's so easy that it looks like magic, like every magic there is a trick. It uses a third-party server to establish the connection.

Similar to Tailscale for Wireguard.

I don't say it's bad, you just have to understand how it works and accept it for what it is.