Except the devices are still quite well-hidden in IPv6 due to the large address space. Good luck scanning even a single /64 behind a normal home internet connec

Except the devices are still quite well-hidden in IPv6 due to the large address space. Good luck scanning even a single /64 behind a normal home internet connection. Only way around that is sniffing the communication (say some cloud service that some IoT device connects to) - which would also give you enough information to send your own packets through the NAT/firewall too. Not very feasible for the average attacker and assumes that the device initiates connections in the first place. If it doesn't, good luck finding it remotely.