We configure fail2ban to use blackhole routing as blocking method. This is more lightweight and does not require any additional software install. iptables is much more flexible, but fail2ban does not make use of this anyway. So if you need more complex firewall rules, then install iptables and you might want to switch fail2ban to use the iptables-based blocking actions. But AFAIK there are no real benefits.
nftables is not yet available on all SBCs we offer, due to outdated kernel versions provided by the manufacturers. Currently the benefit is marginal, so we stay with iptables for e.g. VPN rules and such, to keep it simple. However RPi just integrated nftables support, I think with the 4.19 kernel or shortly afterwards, so one can install and configure it there.
Before offering to choose between iptables and nftables within DietPi-Software, or do the choice based on kernel support, I rather wait for bpfilter. This has MUCH more benefit over the other two. However will take some time until it is integrated into the majority of ARM kernels.