Everything is a compromise between security and convenience. Yes, UPnP does rely on no system being infected in your home network. Not that difficult, just don'

Everything is a compromise between security and convenience. Yes, UPnP does rely on no system being infected in your home network. Not that difficult, just don't connect Apple devices and Samsung TVs or put them in a vlan where UPnP is disabled. But today security itself can become a problem. UEFI for example is basically locking boot loaders on PCs. Good luck getting your OS approved (by Microsoft for that matter). There are theoretical attacks like this one , but when was the last time you had malware and then malware affecting boot? Is it worth locking the boot loader and endanger general purpose computing? I don't think so. While mechanisms like TPM are useful in cloud land, it is basically a scam for private devices. Because it would turn your PC into an Apple device too. And then you would need to disable UPnP. What a bother.