Compromised routers can be used to compromise devices behind it. Also many devices (like IP cameras) usually have port forwarding to allow the users to access it from outside.

Many devices use UPNP to automatically punch a hole through the NAT and expose their ports to the world.

Pretty much every router is sold with UPnP turned on.

Many IOT devices use UPnP to open their interface to the world.

This is an interesting approach to get past NAT: https://thehackerblog.com/sonar-a-framework-for-scanning-and...

>Most CPE's running IPv6 will be following RFC 6092.

It's pretty naive to think that any CPE will be following any kind of norm or rule.