I think they have to for tunnels to work. They rewrite the headers so the target server doesn't have to have any special config to recognize abc.example.xyz as being itself.

I think in theory you could get it without it but that would be a lot more work on the recipient side.

Me I'm less worried about that so I accept the convenience of not having to setup a reverse proxy and poke a hole in my router.