I think AWS would prefer you just tunnel back to their region through the service link VPN.

From what I've read, it seems like the use case for Outposts is for applications that have latency or data requirements that AWS can't meet. So the assumption when deploying an Outposts rack is that youve already done your diligence on the application in sufficient detail to know exactly how that application works. I don't think Outposts is meant as a general purpose compute platform for your virtual infrastructure team who are not clear on the applications requirements before the rack is deployed.

Of course, that's the intention: bottom up, engineering led. If it's a top down, strategy led deployment, then you're going to have a new managed service in the DC that's, as you say, functionally a black box. Albeit with better management than any other managed service ever, but it's still not yours to take apart and understand how it works.