Also (as feikname points out in another comment) because if you're relying on your NAT for security, your security boundary becomes your network, not your machi

Also (as feikname points out in another comment) because if you're relying on your NAT for security, your security boundary becomes your network, not your machine. If you read post-mortems of security breaches, it's really common for the initial intrusion to be a printer, or webcam, or an intern's/secretary's/nonprivileged user's device, which then pivots using the internal network to gain more access.