--x-sendfile cli flag is only meant for the 'filestore' folder. 
This flag is for odoo to do some permission check before handing out the file, while servering those 'attachments' over your reverse proxy. 

Typically like this:

in your systemd service file, add --x-sendfile flag the the exec line as cli flag. 

in your Nginx config file, add 

location /web/filestore {
    internal;
    alias /opt/odoo/.local/share/Odoo/filestore;
}

I believe Nginx shall have read access to this path. The sub path inside filestore folder does not match the request uri as the file path and actual uri would be dynamically mapped by odoo after doing permission check. 

While for  static files, it is servering them via Nginx directly without permission check by odoo. 
You would do something like this:

location @odoo {
    # copy-paste the content of the / location block
}

# Serve static files right away
location ~ ^/[^/]+/static/.+$ {
    root /opt/odoo;
    try_files /community/odoo/addons$uri /community/addons$uri /enterprise$uri @odoo;
    expires 24h;
}

When your addon path is like

/opt/odoo/community/odoo/addons,/opt/odoo/community/addons,/opt/odoo/enterprise

And yes, Nginx needs read access to those paths. 

Reference:

https://www.odoo.com/documentation/16.0/administration/install/deploy.html#serving-static-files-and-attachments  (there's some errors in this link)