> If anything, NAT has saved millions of wildly insecure devices running unpatched old Windows versions from getting pwned the second they connect to the open internet.

I doubt it.

Very few devices do port NAT without also doing firewalling, since firewalling is simpler.