Compromised routers can be used to compromise devices behind it. Also many devices (like IP cameras) usually have port forwarding to allow the users to access it from outside.

This is an interesting approach to get past NAT: https://thehackerblog.com/sonar-a-framework-for-scanning-and...

Many devices use UPNP to automatically punch a hole through the NAT and expose their ports to the world.

Pretty much every router is sold with UPnP turned on.

Many IOT devices use UPnP to open their interface to the world.