How is this any different to IPv4? An incoming default deny rule on your firewall offers the same protection as the "accidental" protection that NAT provides, and you can translate/proxy/VPN/whatever-else IPv6 addresses/connections in all the same ways you can with IPv4 in order to disguise the source IPv6 address if you really have a need to.

Heck, if you are worried about security having a /64 allocated means that if you aren't providing incoming services you jump around a huge range if you want to so you don't need to be at the same address now as you were an hour ago (unless you have active TCP streams or similar that have been running that long), and even without moving around if you pick your address within the /64 arbitrarily you aren't going to be found by a port scanner in any amount of time that would make scanning a practical option.

> IPv6 to IPv4 NAT exists but is stateful.

Isn't IPv4 NAT stateful when translating potentially many source addresses? Otherwise how do you reverse the translation when response packets arrive?

A one-to-one mapping shouldn't need to be stateful, but where that is useful most people go with being dual-stacked instead.