Armbian uses Netplan by default to manage network settings. But when it uses NetworkManager as renderer, it silently changes iptables rules—without asking, without telling.
*Neither Netplan nor NetworkManager are supposed to manage firewall settings.*
But they do it anyway, behind the scenes. That kind of behavior—making security changes without user consent—feels a lot like what malware does.