Worth noting that "behind NAT" is not a security measure. Technologies exist that circumvent NAT to various degrees (and that's usually without malicious intent!). WebRTC is a famously annoying example of this where it's got tons of legitimate applications but has also been responsible for serious security issues, especially in earlier implementations.