That's crazy. How does that work? Do I use the cable for the through, and then just run S21, or do I need to use one of those fancy features I haven't properly tried yet?
Yes, if your VNA supports that, you can use the cable as a thru, and then simply run a S21 measurement. That's what I did in the measurements I posted above -- the DUT is the thru. R&S calls that UOSM, but this method is also known as unknown thru or SOLR (short-open-load-reciprocal). It relies on the assumption that the 2-port device used as a thru is reciprocal, which is true for a cable. It was first published in 1992 in an IEEE Microwave and Guided Wave Letters volume by A. Ferrero and U. Pisani.
The method is based on the 8-term error model for VNA measurements (using error two boxes at each port, each described by ABCD-parameters), and this error model can be converted to the usual 12-term error model by using additional measured quantities, the so-called switch terms. These are the ratios of the incoming and outgoing wave amplitudes at one port while the other port is used as a source. This requires the VNA hardware to have four receivers (in a two-port VNA).
Sounds magical, but it works.

At first sight, the math behind it is a bit confusing though.