The statement "there are far fewer ways to attack a machine behind NAT with no user interaction" is true even though NAT on it's own is not designed to be a firewall.