You might want to look here: How to disable calling to stun.ekiga.net, etc ?
It’s from a very old version released ~5 years ago but it’s the only thing that I could find here that answers my question on whether STUN gets disabled if NAT traversal is disabled. As the user who posted it back then did disable NAT traversal and yet his Syncthing installation appears to still trying to contact one of the default STUN servers.
Although on the device authentication and certificates part of my questions, I now felt somewhat relieved by the answer. Thanks for that one.