The fact that docker still, in 2026, will completely overwrite iptables rules silently to expose containers to external requests is, frankly, fucking stupid.

Indeed. I've had even experienced sysadmins be surprised that their ufw setup will be ignored.