It doesn't have to get "through NAT", that's not how NAT works. NAT is an address remapping function that can be configured to happen for some particular packet

It doesn't have to get "through NAT", that's not how NAT works. NAT is an address remapping function that can be configured to happen for some particular packets and has nothing to do with the forwarding function/routing that is completely orthogonal to it. Typically, NAT on home routers would be configured to remap the source address of packets coming from the LAN interface destined to the WAN interface as well as any packets in the opposite direction that match flows that were remapped in the outbound direction. If someone (your ISP, someone who compromised your ISP's router, someone who happens to be your neighbour on an ISP with misconfigured routers ...) sends a packets directly addressed to your internal address range to your WAN interface, that is of no interest to the NAT function and will simply be routed to the LAN interface unchanged. That is: Unless the device happens to also have a stateful firewall that would prevent that. But then, the firewall would work just as well without NAT.