> And this is... actually not true. If there's a server listening on the relevant port, the connection is accepted.

Fine. Packets that arrive at the router with the router's own IP address and a port that doesn't correspond to either an open connection, an explicit port forwarding rule, OR the port of a service on the router itself listening on the WAN IP will also get refused.

The point is that any LAN box sitting behind the NAT will not get that packet, same as if the router had a stateful firewall running.

And sure, this is not purely a property of the NAT itself, it's a combination of the Internet not routing private IP addresses, reverse path filtering, and NAT. That still doesn't need any firewall to achieve this.