Typically, servers have easiest to configure NAT/firewall/port forwarding and clients (to me) are basically thought of as "not going to get through their router/firewall configuration no matter what".
Because WireGuard is a P2P protocol and if you want the server could be behind a NAT (eg. reverse shell). Very useful for accessing your home machine without having to open up a port etc. In the near future noisysockets will get NAT traversal support (with a Nebula lighthouse type server) which will make this use-case a lot simpler.
The flow I've seen is "Wireguard server has its listening port open. Clients (with all ports closed) connect to the server on its open port."
After that, all connections can still happen. Server -> client, client -> server.
> NAT Traversal: The NAT entry created by the client's outgoing connection allows the server to send packets back to the client.
> VPN Tunnel: The established VPN tunnel enables bidirectional communication, allowing the server to reach the client without the client needing an open port.
