> Because they did ship like that, years ago
Yeah, years ago.
Years ago there was no encryption whatsoever.
"Host based" authentication was common. And not the type that used certificates (or, in fact, cryptography of any kind), but the kind where you would enter IP addresses, host names, or even just patterns of those into a file called ".rhosts", and those then were the hosts that were allowed to run commands as root completely without further authentication.
When you shared a folder in Windows using SMB, you usually shared it to anyone, including the Internet. Windows did not even have a good concept of separate user accounts. This is not an exaggeration, a very significant portion of unsuspecting users had their hard disk made available to everyone because they intended to share it with their own little local network. No password, no nothing.
The Internet was littered with public FTP servers, of which a lot, and a lot of very public ones, had a directory called "/incoming" where you could upload and make available things for everyone else.
IRC had a thing called "CTCP", client-to-client-protocol, with which two users' IRC clients communicated directly, client IP to client IP. That's right, you were chatting (or not chatting) to some "rando", and they not only had your IP address, they had the ability to send commands to your IRC client.
WiFi, for a surprisingly long time, had encryption optional. And when it was turned on, it was easy to crack.
The Internet was a very trusting place, and became gradually less so. With or without NAT, routers would have added strict, stateful firewalls, for the same reasons that everything else I've written above stopped.