The only default-deny rule for incoming traffic for general-purpose, up-to-date hosts should be the one built into the OS which rejects incoming connections to

The only default-deny rule for incoming traffic for general-purpose, up-to-date hosts should be the one built into the OS which rejects incoming connections to ports where nothing is listening. (If you enable UPnP, as most routers do by default, this is the policy you actually have in practice… just with more steps.) If you can get around the firewall rules with something like STUN then those rules aren't really doing you much good, are they? By all means, put random IoT devices on a separate VLAN and block all incoming connections directed there (without UPnP). And be sure to block all the obvious workarounds like STUN for that VLAN or there's no point in having the firewall. But for PCs, smartphones, and the like it should be possible to connect to their open ports from outside the network using their public IP addresses without any tweaks at the router. These devices are perfectly capable of securing their own listening ports.