The ACL is for UDP only BUT is already forced through R2 to reach 10.10.10.10.
The BW is higher via R4 so that's the path TCP will take, so adding the TCP to the ACL forces it also via R2.

In an MPLS VPN network, OSPF is often used as the routing protocol between the Provider Edge (PE) and Customer Edge (CE) routers. A problem arises when there is an OSPF backdoor link between two CE routers in the same OSPF area. This link may be preferred over the MPLS VPN path, as OSPF inherently prefers intra-area routes over inter-area routes.
A sham-link is configured to create a logical intra-area link between the PE routers, ensuring that traffic uses the MPLS VPN backbone instead of the backdoor link. This allows the MPLS VPN backbone to maintain OSPF intra-area routing and avoids the suboptimal routing caused by OSPF's preference for intra-area routes.