> You want wireguard to be the software that takes the packets first.

Congratulations, DPI marked your connection as... WireGuard and blocked it.

I'd say you are now double safe - there is could be no RCE if there is no packets at all.