You are correct.
The reason NAT is seen as security on home networks is that, absent a firewall, it acts as a default deny to inbound traffic.
The reason NAT is seen as security on home networks is that, absent a firewall, it acts as a default deny to inbound traffic.
It doesn't actually do that.
You don't need to take that on faith either -- you can just test it.
How do you want to go about doing this? Although, 100% of the time people have asked me to do this they chicken out at actually doing it, so I suppose you will too. You might prefer to test with some network namespaces instead.