IMO, SNI should only be added at the firewall (using HTTPS proxy, for example), so the network operator can monitor/filter which hosts are being accessed.
If you actually have a "HTTPS proxy" then the entire transaction is plaintext at that proxy, the operator can do whatever they want.
In particular they can choose whether they want to support protocol extensions like eSNI or ECH on either or both sides of the proxy.
If your idea is "But surely it should just pass through extensions it doesn't understand" what you've got there is nonsense, it isn't a "firewall" it's a dumpster fire. The extensions have meaning to the peers, if it tries to pass extensions through without understanding them it's now speaking gibberish to both sides.
