You're misunderstanding the purpose of NAT, which is not a security boundary. Apple, for instance, has (or had) nearly all of their workstations on a public IP

You're misunderstanding the purpose of NAT, which is not a security boundary. Apple, for instance, has (or had) nearly all of their workstations on a public IP space. You can still equally as effectively firewall and port map devices on public IPs as you can behind NAT -- and actually just a bit easier, since you're taking NAT out of the picture.