You're misunderstanding the purpose of NAT, which is not a security boundary. Apple, for instance, has (or had) nearly all of their workstations on a public IP space.

You can still equally as effectively firewall and port map devices on public IPs as you can behind NAT -- and actually just a bit easier, since you're taking NAT out of the picture.

Do you have a gateway that doesn't do ipv6 firewalling (e.g. allow outgoing, only allow established incoming)? I was under the impression that even no-names manage to get that correct. Why would you need port mapping if not for NAT? Even with NAT, for home use I was always mapping port n to n.