A few occasional mild annoyances from the marketing team is worth tolerating for a reasonably secure operating system. I'd argue people who feel otherwise need to reprioritize their risks.
List the last known remote exploit that will work for someone behind a NAT, and that doesn't involve visting a malicious site with all the default settings of IE or downloading and running an executable (at which point nothing will save you but the most authoritarian of walled gardens.)
Don't forget, the new stuff is not free of attack surfaces either.
NAT is not a firewall (though it's usually paired with one). And the NAT is usually one hop away from the computer, so it provides no protection against an attack coming from the same network (like a worm on a coworker's laptop).
However, AFAIK Windows 7 does have a built-in firewall, which (depending on the settings) might help protect even against an attack coming from the local network.
However, bear in mind, as others said, NAT isn't a security feature, it's just an annoying roadblock that helpfully makes accessing computers somewhat more difficult. However, quite a few applications on the average PC reach out and touch other services, granting malicious actors plenty of ways into a PC.
I get the hate on walled gardens, as a big antitrust supporter, but unfortunately, Windows 10's app model (universal apps) gets a bad rap because of the Microsoft Store being generally considered attached to it: UWP apps are basically the safest way to run apps, because UWP apps cannot harm other things outside of their little sandbox. And contrary to popular belief, it's entirely possible to create, distribute, and install UWP apps without the Microsoft Store. Microsoft has definitely had some missteps in both rolling out and marketing the newer app model, but it is the future.
Sandboxed applications not only provide unparalleled security, they also are incredibly stable because other apps can't tamper with them either. By being self-contained, developers can generally be confident the app will work on any machine without issue.
I ask as even at home, my different devices all use the same browser/extensions, VPN and browsing habits. I use established FOSS where possible and the only problems I have had since Windows 98 are from data breaches (nothing I could have prevented with different OS/software).
Or are we talking about business/corp usage?
Hardware-enforced Stack Protection: https://www.zdnet.com/article/google-chrome-this-new-feature...
Significant improvements to ASLR starting in Windows 8: https://msrc-blog.microsoft.com/2013/12/11/software-defense-...
And many more things. New Windows releases aren't just coats of paint.
Guarding one protects the other.
Need to do those in different ways at different times.
We still have to keep a couple winxp and nt boxes alive at work for diagnostic gear (none are online). Thankfully not my job as I am obviously a risk :)
Windows 10 was technically vulnerable, but since Windows 10 has drastically better security features, from a defense-in-depth standpoint, having Windows 10 more or less rendered most computers immune in practice. (Likely, the few 10 machines infected were intentionally crippled by their admins.)
Bear in mind, Windows 7 is an OS from 2009, 12 years ago. It's ancient from a computer security standpoint.
Whether you are personal or corporate, you probably should be running either Windows 10, or choose an alternate operating system entirely like OS X or Linux.