One framing of the problem: “Honest nodes are not as reachable as attacker-controlled nodes. This gives attackers an extra advantage when trying to occupy outbound connection slots.”
Some supporting data here: Outbound connection success rates of a Bitcoin node - #3 by b10c - Observations - Bitcoin Network Operations Collective
With that framing, I think having some sort of holepunching would be very valuable. Option 2 seems like a good start, given that the % of nodes advertising a Tor address (already have Tor working) is quite high.