Comment by bmgxyz

This blog post[1] may interest you. As you suggested, the workflow seems to be:

1. Try various techniques that might trick the firewalls on both ends to let the connection through. This requires a relay for the initial negotiation only.

2. If (1) fails, then use a relay for everything.

[1]: https://tailscale.com/blog/how-nat-traversal-works/