Most of them actually wouldn't because they have no reason to do it and creating the mapping for no reason is work. Making the thing where you're not exposed to

Most of them actually wouldn't because they have no reason to do it and creating the mapping for no reason is work. Making the thing where you're not exposed to the internet the thing that lazy developers get by default is a win. Some of them could do it for no reason, but they could also have the devices make outgoing connections to the company's servers and then blindly trust any data the servers send back, even if the servers are compromised or the domain expires and falls into the hands of someone else, or the company's own servers are simple relays that forward arbitrary internet traffic back to their devices. If a device can make outgoing connections then it can emulate incoming connections. Blocking incoming connections to devices that explicitly request them is therefore not a security improvement unless you're also prohibiting them from making any outgoing connections, because the result is only that they do it in a less efficient way with more complexity and attack surface and less visibility to the user/administrator.