If you operate WebRTC at any meaningful scale, somewhere between 8% and 20% of your sessions will fail to establish a direct peer path and will fall back to TURN relay. The relay is the only architecture that works in those cases. It is also the one that turns your egress bill into a function of usage instead of a fixed cost.
Why the percentage is non-zero
Symmetric NAT is the polite name for the configuration that defeats hole-punching. It is the default on a meaningful slice of corporate networks, on most carrier-grade NAT, and on a long tail of consumer routers. The fact that direct paths work most of the time obscures the certainty that they will not work some of the time.
The percentage drifts upward as your product grows internationally. Carrier-grade NAT is more common in mobile-first markets. Plan for higher relay rates in those geographies, not lower ones.
Bounding the cost
Authenticate every TURN session. The default open relays you find in tutorials are a billing event waiting to happen. Use ephemeral credentials scoped to the session, expire them aggressively, and never let a TURN URL leave your client without authentication metadata.
Place relays close to users and route by proximity. A relay session that crosses an ocean costs more than the call is worth. Run regional TURN clusters and route by geo before you route by capacity.