Ah, so parking the issue of NAT for a moment, it turns out adding port 443 didn't work after all.
Although COD was showing my preferred German VPN under Geographical Region in the in-game settings, it was actually routing traffic through my local UK server. I noticed because the latency was too low.
I then did some tests with a far away VPN server in Los Angeles and got the same result (sub 20ms). When I went back to Hybring VPNing the Playstation as a whole (not specific services) the latency jumped to 200ms, so I knew the VPN was working.
Tbh it's not really a massive issue. I can at least get the VPN to work, which is the most important thing. I just got to keep enabling Hybrid VPN whenever I want to play COD, and disabling it when I don't.
But it would be nice if I could just get the add services feature to work. If there's another PS5 owner out there that uses Surfshark, lemme know where I'm going wrong...