You are right about being born on a military base overseas. My two daughters were born at S. Ruislip AFB in England and I needed to file for a CRBA with the Embassy to declare their American citizenship. I was informed by the Consul that they are not NBC.
You are wrong about McCain. Children who acquired U.S. citizenship or U.S. nationality at birth in certain territories of the United States during relevant time periods are not eligible for a Consular Report of Birth Abroad. They are not eligible because such persons are not considered to have been born abroad.
Panama Canal Zone was one of those. Ref: https://citizenpath.com/consular-report-of-birth-abroad/
The American military hospital in which McCain was born was located in Panama City, NOT in the Canal Zone. So, technically, he was born in Panama. There are possible arguments in his favor, but the issue is not really clear.