AKS UDR outbound type and NAT gateways

I want more control over my egress traffic so I would like to use a UDR outbound type. In my case, I want to route specific IPs to an NVA, while letting all my other traffic route via the internet through a NAT gateway. I do not want to use Azure Firewall or any other NVA for my internet traffic. The [documentation on UDR outbound types](https://learn.microsoft.com/en-us/azure/aks/egress-outboundtype#deploy-a-cluster-with-outbound-type-of-udr-and-azure-firewall) adds the following info notice:

> Outbound type of UDR requires there is a route for 0.0.0.0/0 and next hop destination of NVA (Network Virtual Appliance) in the route table. The route table already has a default 0.0.0.0/0 to Internet, without a Public IP to SNAT just adding this route will not provide you egress. AKS will validate that you don't create a 0.0.0.0/0 route pointing to the Internet but instead to NVA or gateway, etc. When using an outbound type of UDR, a load balancer public IP address for inbound requests is not created unless a service of type loadbalancer is configured. A public IP address for outbound requests is never created by AKS if an outbound type of UDR is set.

While I agree with this text in the general case, surely this doesn't apply in the case where a NAT gateway is assigned to the AKS subnet? **I should be able to route default traffic via "Internet" when I have a NAT gateway as Azure is providing the SNAT to a public IP for me.**

The [NAT gateway](https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-gateway-resource#connect-to-the-internet-with-nat-gateway) documentation reflects that the "Internet" destination maps to the NAT gateway when it is associated with a subnet:

> No additional routing configurations are required to start connecting outbound with NAT gateway. NAT gateway becomes the default route to the internet after association to a subnet.

I know that there is now a NAT gateway outbound type, but that does not give me the ability to set UDR which I require.

As an aside, I've been able to get around this restriction by adding the `0.0.0.0/1` and `128.0.0.0/1` routes to route to "Internet" while I have `0.0.0.0/0` routing to a non-existent NVA.

Example diagram: