ntp out of the box seems to be working fine! Its nftables that is the issue!
add udp 123 to the /etc/nftables.conf file.
I just included it into the existing 3cx udp ports! (in bold below!)
# 3CX PhoneSystem specific
tcp dport { 80,443,5000,5001,5015,5060,5061,5062,5090 } ct state new counter accept comment "Accept 3CX PhoneSystem TCP ports"
udp dport { 69,123,5060,5090,7000-10999 } counter accept comment "Accept 3CX PhoneSystem UDP ports"
The ntp conf that pertains to above!
/etc/ntpsec/ntp.conf
# By default, exchange time with everybody, but don't allow configuration.
restrict default kod nomodify nopeer noquery limited