Your attack surface is primarily your firewall which admittedly might be an easy target - but not as easy as an unprotected Windows box.
The use of small private pools has even helped attackers who would inject browser scripts probing the well-known prefixes.[2]
[1] https://serverfault.com/questions/374126/private-ip-getting-...
[2] https://www.bleepingcomputer.com/news/security/new-behave-ex...
NAT was an added layer on top of firewall rules because inbound ports had to be mapped to a particular host and port since the router would not know which host to send to. This created a default opt out experience because for a port on your machine to get accessed, a packet must pass inbound rules and match a port map table entry.
Port mapping and connection tracking firewalls were invented in 1989,[1][2] while network translation was created in 1994. [3][4] The private address space was only reserved in 1996.[5] The Firewalls book was published in 1994 (which meant that it was being written in the 1992-3 timeframe).[6]
People were protecting networks before NAT.
[1] https://en.wikipedia.org/wiki/Firewall_(computing)#Connectio...
[2] https://en.wikipedia.org/wiki/Circuit-level_gateway
[3] https://www.rfc-editor.org/rfc/rfc1631
[4] https://en.wikipedia.org/wiki/Cisco_PIX
[5] https://www.rfc-editor.org/rfc/rfc1918
[6] https://en.wikipedia.org/wiki/Firewalls_and_Internet_Securit...
Which is why all sorts of software needs to deal with bullshit like STUN, TURN, etc, to get peer-to-peer connections working. There has to be all sorts of address discovery.
* https://en.wikipedia.org/wiki/NAT_traversal
And even that won't work once you get into CG-NAT with tends to have two layers of NAT.
How much of the centralization of the Internet has occurred because people can't just talk to each other (by simply firewall hole punching via UPnP/PCP)?