It's not even that. Well, it is, but it's two separate things: you need a publicly-addressable server to host this code, for all the peers to connect to in order to discover each other and exchange session information. You could also host this locally and use something like ngrok to provide the publicly-addressable endpoint.

The NAT hole punching is done by the STUN servers listed in script.js. They appear to be public third-party STUN servers, so that could be a vector for a malicious actor. There are also third-party TURN servers listed, which will relay media in the case that NAT traversal fails. That should be ok too, but could also be another attack vector.

huh, interesting. I’m sure there’s a use to this extra layer of “obscurity” after the sibling comment.

Don't need NAT with IPv6