How does this differ from tunneling a VPN over something like wstunnel?

We've been running that in prod for several years without any issues, also going through cloudflare

Websocket is a protocol that when used it's rather obvious what you're doing. This is designed to look like actual web traffic.