Misconfigured firewall is a gaping hole. Misconfigured NAT is not letting data from outside into your local network.
So firewall is actually worse than NAT.
So firewall is actually worse than NAT.
Personally I'd count "your security thing doesn't actually do the thing it's supposed to do" as being pretty bad on the security scale. At least people understand firewalls.
Yes, that's called port forwarding and it is normal thing. You actually want that.
NAT doesn't apply to inbound connections if you don't have a matching port forward rule, so it kind of doesn't matter how NAT works here. This is pure routing, not NAT.