That's also how I understood it. Your NAT usually blocks incoming connections by default - it does not know which computer in the network behind it was meant to

That's also how I understood it. Your NAT usually blocks incoming connections by default - it does not know which computer in the network behind it was meant to be the receiver anyway. If you direct your NAT to send all incoming connections to one PC, then this PC is vulnerable.