You configure your router to not use NAT for IPv6, and get your ISP to provide you more than a /128, is how. This is why industry is adopting it and consumer devices aren’t.

(IPv6 space is big enough that there’s no reason that residential ISPs shouldn’t be assigning everyone larger prefix ranges by default, but that doesn’t mean they will. They probably think they can up-sell it. Thread is a great, simple protocol for the hypothetical world where the residential ISPs give up on this practice. It’s not so great for the world we’re in, unless you’re already using some separate VPN overlay network.)

"without a middleman" means it won't rely on some 3rd party to work. As a contrast, for example, a SmartThings hub requires an internet connection to work because (almost) everything is sent to Samsung first.

Whether you want to connect to your home directly over the internet is up to you, in this case.

The goal of this is to be hosted on a router. I'm assuming it wouldn't go around NAT as much as replace NAT by replacing router's firmware.

You've guessed correctly that this is one of the most painful parts of the setup. I use a different open source product for the same purpose (Home Assistant), and it allows me to go around NAT manually (use dynamic DNS service, open up the port on a router, route it to a local device, issue a Let's Encrypt certificate) or pay them a few bucks per month to ease the pain.

Mozilla hosts an https tunnel for subdomains that match YOUR-subdomain.mozilla-iot.org where users choose a unique subdomain and a cert for it is auto-installed (using LetsEncrypt) onto the RPi or Turris Omnia during first time setup. In the future once the WebThings Gateway has control over edge firewall rules, then the tunnel can go away in favor of a "hole" for 443 or a port forward rule for https access directly to the gw. Privacy risks are far reduced if we all run our own local smart home gateway in our homes.