imo the protection is real and a good tradeoff for a research project to become a mass medium (i.e. clients usually don't want incoming connections from the internet[1])

don't get me wrong, i like a global address space as much as the next internet native, but it's not for everyone to pay the price for it and nat makes it easy to opt-out of a large portion of the problem space.

[1] my university used to give public-routed v4 to students connecting their winxp laptop to the network; guess what happend