I asked because I would guess that the vast majority of devices that are potentially affected are behind NAT, and they are likely to be safe from outside threat

I asked because I would guess that the vast majority of devices that are potentially affected are behind NAT, and they are likely to be safe from outside threats until one is introduced through users or some other hack. Nowhere was it suggested that NAT was part of the security strategy... which you are right, is a very bad idea.