The "behind a NAT" argument fell apart back in the days of the Nimda worm (2001) in my experience. I saw multiple environments where vulnerable machines were in

The "behind a NAT" argument fell apart back in the days of the Nimda worm (2001) in my experience. I saw multiple environments where vulnerable machines were infected when portable computers became infected while attached to third-party networks and were subsequently brought back "behind the firewall" to infect other machines. The lack of defense in depth, lack of segmentation, and the general "soft, chewy center" of most networks is arguably the cause to blame. Still, most third-party networks I see even today are this way.