My understanding of UPNP is that it allows the router itself to become a discover-able device on the network. Then the IoT device connects to the router and add

My understanding of UPNP is that it allows the router itself to become a discover-able device on the network. Then the IoT device connects to the router and adds a static port mapping from the router's public IP address on a specific port to the IoT's private IP address. The NAT still works as it normally does where any packets that try to leave the network get remapped by the router seamlessly. The danger in this case is the IoT device has a listening port on your public IP address, allowing attackers to connect directly to it through your router.