Hole punching is ineadequate for routers with address-dependent NAT mappings or with DS-Lite/CGNAT. With UPnP-IGD or NAT-PCP/PMP the CPE can forward the port mappings to the AFTR/CGN.

UPnP / SSDP is a half baked standard will be a thing for the foreseeable future unfortunately. I say half baked, because with just a little effort and critical thinking, users would have full control over the interaction between their systems and their routers.

For starters, a lot of gaming companies now depend on people having this so that the users run the servers instead of the gaming company having to pay for the infrastructure. They won't begin to explain to kids how to forward ports.

Many app makers now assume this as well and certainly do not want to explain to non technical users how to forward ports to a machine on their network.

IoT is just leveraging an existing precedence.

I guess that's how we end up with situations like http://www.insecam.org/

I think this kind of knowledge should be common, I mean, you should have a "network" course at school, learn how to forward ports and basis about how internet works.

Well, this is another discussion.