I can’t think of a single time I’ve wanted to connect between two hosts when I haven’t specifically allowed one through a firewall
Not that my WireGuard connection needs nat as it terminates on my router. And I use private ip ranges as I want to be sure that if WireGuard drops out for some reason traffic doesn’t route over the unencrypted path. Defence in depth.