So with no TURN, how does Jitsi work with people behind a firewall / NAT?
That part isn't really correct? Most firewalls block incoming connections not outgoing ones so both parties agree on a port, hole punching happens and then there is a connection is formed.