I am no security expert, but if a machine in the local network gets infected and tries to access your ME, then NAT can't prevent the attack. That's the only other vector I can think of.