The PPP interface has a dynamic IP address. This rule intercepts network requests to most IP addresses and feeds them to a proxy program. The server happens to be an ssh client process connected to a server on the firewall. The server on the firewall happens to be netcat connected to the final destination telnet server. The connections have all the benefits of ssh, including security and compression.
Connections are really expensive to create.
Whether you're logging into a host or just fingering it, ssh does the whole secure key and options exchange, multiple times if there are multiple ssh-based proxies. The two techniques are different. Each performs better under different circumstances and each has different auditing, logging, and control capabilities. PPP over TCP dies horribly if there are lots of lost packets on the underlying TCP connection, and it requires root access at both ends to run pppd, and it requires IP addresses recognized by all hosts at both ends. Forwarding each connection in a different ssh connection via transparent proxy can kill the server running the transparent proxy if there are dozens of connections, but it only requires root access at one end of the connection, and many outhosts can use the same IP addresses.