Why does ESBC relay non-SIP TCP traffic out-of-the-box without explicit configuration?

Hello,
My Oracle ESBC version is SCZ10.1.0 GA.

I am testing an IVR → Oracle SBC → TTS Server workflow, and I observed an unexpected behavior regarding how the SBC relays the independent TCP control stream (MRCPv2) that I'd like to understand architecturally.

The Call Flow & PCAP Analysis:The call starts as a pure audio call.In the middle of the call, the IVR sends a SIP Re-INVITE to trigger the TTS capabilities. The SDP explicitly negotiates the MRCPv2 channel as follows:
m=application 9 TCP/MRCPv2 1
a=setup:active
a=connection:new
a=resource:speechsynth

Naturally, this SIP Re-INVITE only establishes the session parameters and contains no application payload (no text to be synthesized).Immediately after this Re-INVITE handshake completes, the IVR begins sending actual application data over the newly established TCP stream. I captured the TCP packets on the SBC and confirmed that the raw MRCP messages (e.g., MRCP/2.0 SPEAK ... <Text Payload>) are being successfully source-NATed and relayed by the SBC to the backend TTS server on destination port.