XDP is intended only for inbound traffic. They are exploiting veth pairs to make outbound traffic "look like" inbound traffic. That's the "loophole".

It's really not a loophole. I think this might literally be in the xdp-tutorials repo.