> behind NAT/firewalls

These are two separate things.

There is no security difference between "route port 80 of one of our public IPs through to my NATted address" and "open port 80 for my public address".

The public addresses are easier to administrate, troubleshoot, log, etc.