SNI is used to allow the frontend gateway to select the correct certificate; it should be harder to block if the frontend gateway instead had a single certificate with all the domains it proxied (obviating the need for SNI).

Of course, that means the gateway must terminate the TLS connection for every site (and therefore be able to read its contents), whereas with SNI it could redirect the TLS connection itself to the appropriate server, while being unable to spy on it.

In practice what happened before SNI is that every SSL/TLS site used a dedicated IP, which makes it quite easy to block.