More than that. They're saying that they're running a userspace implementation of both the tcp/ip stack and wireguard. Your machine isn't a peer to the wireguard tunnel, only flyctl is.
You can’t make connections with other processes over the same connection flyctl makes when it’s doing stuff.
That is what GP is saying.