You can minimize attack surface, but it's silly to depend on NAT for security in any way, especially since so many devices can act like black boxes with arbitra

You can minimize attack surface, but it's silly to depend on NAT for security in any way, especially since so many devices can act like black boxes with arbitrarily insecure connections to who knows where. You can't trust that subnet alone validates a device - "but it's in the dmz!" You have to design security around never (when possible) giving a host an opportunity to screw things up. Assume every host will be hostile at some point in its lifetime - zero trust or bust.