Your service (anything that accepts incoming connections) is never exposed to open internet. any incoming connections are guaranteed to be from authenticated and authorized clients.
> I assume it does little to thwart traffic analysis?
It does -- the traffic is routed throw OpenZiti fabric.
> Does it suffer from tcp-over-tcp problems?
OpenZiti is not a VPN and it does not forward network packets. In application embedded cases payload is end-to-end encrypted and forwarded on overlay network.
> Would be fair to say it's similar to a private Tor network with hidden services - but without anonymity and (probably much) higher throughput?
I believe that is a fair comparison, except anonymity is replaced with strong identity support to allow configuration of authorization policies.