Can anyone explain to me. So right now for v4, we have NAT, and several ways to get a port open and pointed at us. With v6, every device has its own public addr

Can anyone explain to me. So right now for v4, we have NAT, and several ways to get a port open and pointed at us. With v6, every device has its own public address, like how the internet was intended. And as sensible network admins, we should have a default deny incoming firewall policy for v6 traffic. But surely that will prevent these "end-to-end" apps from working, and now they don't even have protocols like UPnP to bypass the firewall and request ports to be opened?