Every firewall I’ve dealt with since forever has default deny on inbound traffic, state full allow for outbound connections. Regardless of NAT or not, and regardless of how cheap it is.
In fact one of the warnings on dd-wrt official IPv6 tutorial: """ Keep in mind it can be dangerous to enable IPv6 without also having a firewall on each client that handles IPv6 packets, or having ip6tables on your router to filter incoming connections. ip6tables is NOT included by default with DD-WRT, which means your clients will be directly exposed to the Internet once you have enabled IPv6. """
If anything, NAT makes you less secure by tricking you into a false sense of security.
(It's also worse if you're deliberately running servers, because it catastrophically reduces the search space needed for a hostile actor to find those servers via network scanning. At least, it does on v6 -- on v4 the search space is already too small to be a relevant factor.)
The dst is going to be the router's address, not one of the LAN's private IPs.
Your router will happily "take" that destination IP. The only reason it won't is because of a firewall, not because of NAT.
IPv6 support is sufficiently widespread that pretty much the only place I can't access IPv6-only services from is the office :P.