This topic has been raised here earlier and this means this change is not well documented in upgrade documents or in the release notes. Only knowing the kernel parameter's name already, I was able to find a small note about this change under 'Software changes' chapter of 'R80.40 Release Notes', but it is not mentioned under What's New -> Clustering, which would be a logical place to mention behavioral changes of ClusterXL.
https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_RN/Topics-RN/Software-Update...
ClusterXL - the default value of the parameter "fwha_cluster_hide_active_only" was changed from 0 to 1. For more information, see sk169154 > Section 3.4 - Standby member's connections.
They should have added a clear statement that traffic from the Standby member to any other host goes through the SYNC interface by default and what NAT rules should be removed, once this feature is active. Like in the sk167453 mentioned by G_W_Albrecht.