>Anti nat advocates seem to fall into the “the network shouldnt provide a stateful firewall” camp

Eh, what?

My entire justification for getting rid of NAT is *because* a default-deny-inbound firewall policy should exist, and NAT is a network patch that functions as a hacky firewall at the consumer level.