direct p2p interaction with residential infrastructure

recently, netnut has been seized by authorities. but looking into how it worked and notice something interesting about the architecture. i forget which exact article mentioned it, but said that the relay server only establishes the initial connection, and then once both ends are established, the customers connect directly to the proxy server so no traffic passes through the relay (so no third party vps can monitor traffic).

how is this actually implemented? i assuming most of the devices on the popa network were behind nat (makes sense right, they are residential), and upnp , port forwarding etcetera is not reliable for every single device they had infected. so makes me question, what actual connection establishment took place here? was netnut solely based over udp and relying on hole punching? this seems unlikely also as this is quite unreliable and heavily relies on nat type. were customers port forwarding/tunneling on their own machines so the bots could reverse proxy back to them? this also seems unlikely as it would surely pose some sort of security risk for the people using the proxy. what did this stack look like, it seems pretty advanced however they are doing it