It uses third party (community-provided) relay servers: https://docs.syncthing.net/users/strelaysrv.html

This can have quite an effect on sync speed. I set it up for my dad and initially his PC and laptop were syncing incredibly slowly. It turned out they both thought his home network was a public one, so everything was going out to a relay server and back.

WebRTC solves this via signalling servers. Data channels are peer-to-peer and traverse NAT.

As others have mentioned, NAT traversal and relays. Tailscale has the best article on NAT traversal I'm aware of: https://tailscale.com/blog/how-nat-traversal-works/