Uhh... you can have a firewall without NAT, including one at the perimeter.

This is a very common misunderstanding. NAT and firewalls are separate concepts. You can also have NAT with no meaningful firewall -- a port remapping NAT that allows anything through.

Most IPv6 networks are firewalled but there's no NAT.