I was afraid of that on the inbound side. It makes sense.
The short answer is sometimes I want full topology-hiding, other times I want the same SIP callid all the way through. Managing it per-profile could work. It has to do with correlating voice-quality monitoring on the private side with other measurements from the public side. In cases where this happens, the same callid on both sides makes things much, much easier.
Yesterday I tried enabling both inbound-use-callid-as-uuid and outbound-use-uuid-as-callid on both the public and private profiles. They didn't seem to have any effect - I still saw a new SIP callid on the b-leg INVITE. I wasn't sure how to debug it from there.