Assuming the router is somehow allowing NAT punctures or port forwarding, or if there is no router, then any easily compromised device will be compromised within 5 minutes of connecting it to the Internet.

Usually much less than 5 minutes. There's just that much Internet scanning.

If NAT is configured properly, then there is no risk.