The default config listens on only localhost which is why it tells you to forward the port using ssh to your own machine to access it from a different machine.
I wouldn't say that the vulnerability in that case was in OpenClaw, but with the router, nowadays it's expected that ports are blocked unless explicitly allowed in the router.
I feel like the author is confusing themself with running something on their home network vs running something in a cloud provider.
I might have to recommend brushing up on your IP/TCP
This is what routers do by default. IP is very different from IP. IP is what they use to know how to route, too long to fit in a post, but MAC to IPs form a local ARP table. Can be many nodes long. Ports are what identify a process in a machine, IP level routers don't care at all about the port (unless you are natting) in order to route, the port bytes are forwarded as is and only parsed by the destination (and constructed by the source)