And, from the Macrothink paper, it looks like it's not so much "open an inbound connection through the firewall" as "trick the firewall into not scanning the pa

And, from the Macrothink paper, it looks like it's not so much "open an inbound connection through the firewall" as "trick the firewall into not scanning the payload". Not relevant for, say, home routers that don't do scanning in the first place.