That's already quite convoluted, and it means that one remote address can only connect to one of the services at a time and you need to reconfigure your router

That's already quite convoluted, and it means that one remote address can only connect to one of the services at a time and you need to reconfigure your router to change which one. It also gives you no selectivity for remote networks that use NAT, so if 1.1.1.1 is actually an ISP using CGNAT for thousands of customers then they're all stuck with going to only one of your services. (If I read your post as written, it also seems to say that the client needs to pick a custom source port and if they're using NAT then they also need to get that source port unaltered through all of their layers of NAT. And they'll be limited to one connection at a time, perhaps one connection for however many people are behind the same CGNAT, because only one connection can use a specific source port at a time.) So yes, you can pile hacks on top of hacks on v4, but it's not similar effort to just permitting the connection in a firewall, and it has a bunch of extra limitations too.