I read that thread and it provided me with some information, but distilled it all to what I wrote above.
I have decided to not run it on ROS7 in MBIM mode rather ECM mode on ROS6 which is working fine. It's a shame that ECM mode is effectively another NAT - behaviour similar to Huawei 4G dongles for instance - but as the carriers use CGNAT anyway it's not a huge drama. I can OOB to this unit as it runs an L2TP/IPSEC VPN to a CHR which is useful as it's going in somewhere a few hours away.
Sending:
/interface lte at-chat lte1 input="AT+QCAINFO"
output: +QCAINFO: "pcc",3148,100,"LTE BAND 7",1,474,-109,-9,-80,15 +QCAINFO: "scc",2950,100,"LTE BAND 7",1,
294,-115,-14,-94,4 OK
This shows that CA is working. Here it's getting 2x B7 off 2 towers.
I didn't test passthrough either in ECM mode - whatever is receiving the passthrough will probably get the same IP address subnet when it does a DHCP request.