> it has a grain of truth to it, at least for home users
No, it doesn't.
> Suppose they want to start with a simple port scan.
Then they shouldn't find any services running on your laptop?
> If my ISP only gave me an IPv4 address, the attacker is out of luck: my laptop HAS NO NAME.
Yes, it does. It's called an IPv4 address. If you also happen to use NAT (which you didn't specify--believe it or not, but you can actually use IPv4 without NAT!), it happens to be a globally ambiguous address. Which doesn't change that it's a name.
Also, your computer has tons of other names via which it can be reached: email addresses, ad networks that your browser loads from, any other ways to send you messages with URIs for you to open and load code from to be executed inside your browser and thus on your LAN, and also all the ports on the NAT gateway's globally unique address that all your outbound connections have been mapped to. Those are all ways to access both attack surface on your machine, and potentially also on other devices on your LAN.
> They can send IP packets to my router, but unless the router itself has unusually serious security holes (such as remote code execution), the router will not send packets to arbitrary ports on my laptop, because there is no way to even ask it to do so.
There is a completely trivial way: You address it to the (globally ambiguous) address of your laptop. That is, unless there happens to be a stateful firewall on that router. But that stateful firewall would work just as well without NAT.
Also, why are you even so afraid of sending packets to "arbitrary ports"? Is your system drowning in malware that opens backdoors left and right? What is so dangerous about your system sending a few TCP resets and ICMP port unreachables?
> Now I get IPv6. The attacker now has a perfectly reasonable way to send packets to my laptop. The router's job is to look at these packets and drop some of these packets while not dropping those that I rely on to browse the web, or whatever. Result: I am one bad config away from having my laptop be accessible from the internet.
In other words: Just as with IPv4. Also, no you are not. There is nothing dangerous about receiving a packet. That seems to be some sort of irrational fear of some people, but it's really just bullshit. The attack surface reachable via email and browsers tends to be magnitudes larger than "oh my god, they can send me packets!!111".
> You mention large enterprises. Sure, they can afford good sys admins. But the average computer user is their own sys admin. Are they ready for this job?
They are as ready as they are for IPv4. They buy or rent a router from their ISP, and the ISP hopefully will continue to supply properly configured devices. They largely managed to do so with IPv4, so there is little reason to think they couldn't do so with IPv6.
> And if you say "yes", then here's the follow-up question: are they ready to administer the use-cases in sliken's comment, and still remain secure? https://news.ycombinator.com/item?id=17140187
Are they managing to prevent incompetent or malicious cloud providers from misusing or mishandling their data? Is their current setup as secure as you seem to assume it is? Also, why should there even be anything "to administer" in the first place? Just because NAT requires port forwarding, which then requires "administration", doesn't mean one has to continue this idiotic tradition with IPv6.