ISP hosting a virtual machine you remote desktop into from internal network as the only way to access the external internet can also work as a "de facto firewall".
But the best de facto firewall is a proper firewall.
But the best de facto firewall is a proper firewall.
The point of my original post is that the author's take is controversial because people are skeptical about whether networks ARE being secured when NAPT is not present.
They are right to be skeptical, in my opinion, because the rollout of IPv6 has been bungled over and over again. That is not a problem with IPv6, its a problem with the adoption of IPv6.