Well, this is interesting… put a new HDD in my TS-216G and booted it.
When it got to the smart installation screen:
…I launched the website from earlier in another browser tab, entered my Cloud Key, and it was accepted:
… and I was then prompted (as-shown above) to login with my QID.
Never exposed any services to the Internet for this NAS.
I suspect when the NAS gets to the smart setup screen, it sends information about itself to QNAP, and that’s how remote login was possible via the cloud key.
I also suspect this isn’t possible once the NAS has been configured.