NPT does that if your default firewall rule is "allow all incoming". Atleast on my router, if I setup NPT it also automatically creates a firewall rule to drop

NPT does that if your default firewall rule is "allow all incoming". Atleast on my router, if I setup NPT it also automatically creates a firewall rule to drop all non-relevant traffic unless I allow it. I feel like I should point out that in IPv4 NAT you also still have a firewall to drop incoming traffic unrelated to anything.