NAT isn’t “security” in the cryptographic sense, but saying “no NAT has no downside to security” ignores what NAT + private addressing is used for: a hard boundary that prevents a whole class of accidental exposure.

Easy examples:

Home network analogy: Your laptop has a private IP (192.168.x.x). People on the internet can’t just connect to it unless you explicitly port-forward. If your router’s firewall rule is messy or you temporarily enable a service, that laptop still isn’t automatically internet-reachable. With public IPs on every device, a single bad rule can put that laptop directly on the internet.

Someone enables RDP/SSH “just to test something"? Behind NAT, it’s usually still not reachable inbound unless you publish it. With public addressing everywhere, one mis-scoped firewall rule (or host firewall disabled) can instantly make it reachable from anywhere.

With NAT, “what’s internet-facing?” is basically “what did we intentionally publish on the edge” (load balancer, reverse proxy, VPN gateway). With public IPs on every endpoint, “what’s internet-facing?” becomes “prove the firewall posture for thousands of hosts and ports,” which is harder and riskier at scale.

You’re right that IPv6 removes the address shortage reason for NAT. But IPv6 does not mean “everything must be publicly reachable.” The IPv6 equivalent of “internal-only” is using ULA (fc00::/7) for internal addressing, and/or using globally routable IPv6 but keeping a default-deny inbound firewall and publishing only through controlled ingress (reverse proxy, load balancer, VPN/Zero Trust).

So the point isn’t “NAT = security.” The point is: NAT + private addressing is a very effective exposure control and mistake-buffer. You can replicate the security model without NAT (especially in IPv6), but you do it with addressing design + strict firewalling + controlled ingres, not by claiming there’s no downside.

You don't want every device on your network publicly addressable, it's going to cause you some problems.

Security wasn't the main concern in this particular case, the headache came from the fact that they were working in IP classes, and we were working in CIDRs (EC2 security groups, for example)

https://cloudnetworking.pro/nat-as-a-security-measure-safeguarding-home-office-users-for-two-decades/

Gm dude sounds like a good dude

Everyone just jacked straight into the internet, straight into the wall, butt naked!

That explains all the semen on the Internet in the 90’s; jacking it butt naked straight into the internet will have that effect.

I bet it's an artifact from beginning of IP and they were given a huge chunk.

There is nothing legally we can about it. I suspect if they were smaller and less monied we could