Hmm, podman also creates rules in the nat table if that's what you're talking about--_if_ you tell it to publish ports.

Of course, if you run rootless then there's no possibility to do so. :)