Drive by downloads are very much an issue regardless of NATing. Taking advantage of browser exploits or bugs to download and execute arbitrary code/executables. note: this is common in compromised or malicious ad networks, so just safe browsing habits are not necessarily enough.