How a cloudbased PBX reaches phones that are behind NAT, am I correct?

The SIP client continuously sends REGISTER packets to the PBX and the PBX continuously sends SIP OPTIONS packets to the client. Most of the time this is enough to keep the NAT session alive in the client router, but sometimes there are issues and you have to tweak the default settings to increase the frequency. You can see the packets for yourself by looking at the signalling.