I'm not sure I follow your analogy. With a NAT configured to only forward certain ports to certain machines, the "bouncer" exists as much as in the firewall cas

I'm not sure I follow your analogy. With a NAT configured to only forward certain ports to certain machines, the "bouncer" exists as much as in the firewall case. The question is not whether a NAT can be an effective firewall; it's that it brings some other, rather unsavory features along with it.