That's right. People want a firewall. Maybe on the devices and/or on the router. But NAT isn't that. It's address translation. Predominantly because there aren't enough addresses available. It's a workaround. And it kills things like VOIP, videoconferences, direct communication etc. And then you need a workaround for the workaround to work around that... If you just want to drop incoming traffic and not expose clients, that's what the firewall is for.