I think due to popular demand and consistency with existing options, it would make sense to have a checkbox to disable STUN/kcp similar to global discovery. I assume there is no meaningful information “given” to the external STUN server, but the fact it comes up is probably enough for some people to dislike it. And at lest to me it is not obvious that you need to modify the listen address to disable STUN. Or go full crowd pleasing by having a checkbox expressing the “I don’t want Syncthing to talk to anything unless I agreed to” sentiment, which disables relays, global discovery and STUN 