(Relays try not to publish their descriptor until their self-reachability
test works, so it seems likely that at some point in the past they managed
to get a connection to their IP:ORPort to work. That or the UbuntuCore
snap package does something weird like setting AssumeReachable to 1.)

Ew, no, it doesn't. See "daemon" and "torrc"-ish files.
https://bazaar.launchpad.net/~privacy-squad/+junk/tor-middle-relay-snap/view/head:/torrc-defaults

It does use tor-fw-helper to ask NAT devices for inbound access. That protocol is pretty hacky.