It bypasses NAT by using a message bus instead of direct p2p communication. A Nostr relay is that middleman and you probably want to run your own relay, so that needs to be accessible past the NAT (could be hosted on a VPS, or you could spam someone else's relay).