NAT, including CG-NAT, provides near zero privacy benefits. Nobody is tracking by IP address - there are far, far, far, more accurate ways, again, I won't reiterate all the ways this happens, Google it (or is the TLS session resumption one still on the front page as one example?)
NAT, and CG-NAT provide real drawbacks. Drawbacks most people won't understand, and that's OKAY. Not everyone needs to understand them, but when you don't understand something, please don't advocate for it with specifics like "happy with CG-NAT because of the security and privacy benefits", instead, just leave it as, "happy with CG-NAT, I don't see any drawbacks".
If all you rely on is NAT, and you turn the firewall on your router off, it is possible for outside attackers to send unexpected packets to through the NAT device and right to your endpoints.
The targets are limited to the entries contained within the NAT translation tables, but that's still a pretty leaky "firewall".
NAT is just not a firewall, all it does is translate addresses, or in the case of PAT, Ports+Addresses. It does not filter the packets it receives, it just translates them.
Having IPv6 will be exactly as secure as IPv4+NAT by default on any CPE. And, just as with NAT+v4, it's possible to open your machines to the world if you have no idea what you're doing.
(This is actually pretty common for gamers who set the "DMZ host" router feature to aim at their desktop and flick off the firewall!)
That depends on the ISP.
Many cable ISPs assign DHCP blocks to nodes that are defined by geographical areas. These can then be correlated with cellphone apps on wireless connections that also return GPS data to the collector. After a few thousand samples you get a really good picture of IP blocks that move and ones that are somewhat static.
these days it's really not much different from IPv4: During the lifetime of a connection, the prefix stays the same, so that's equivalent to the IPv4 address before that.
The actual machine address rotates very often, so there's no real value in using this for identifying unique devices.
If you want to profile specific devices, you're much better off using the same attributes you were using with IPv4 (user agent, TTL, other protocol specific fingerprint techniques)
The only thing that stays static across connections is the provider assigned prefix and that’s equivalent to your dynamic ipv4 address.
At the least, they should push a null default route to users that connect (assuming we're talking about the kind of VPN services that advertise as "protect your privacy with a VPN!").
But crappy ones don't. And some people end up using crappy ones, because they don't know any better :(
Or rather: Using IPv4 doesn't guarantee non-crapyness of a VPN provider.
But: Working IPv6 support guarantees at least some level of proficiency by the VPN provider, so they might be more reliable candidates to begin with.
But there's more needed with IPv6 than routing properly. The VPN provider needs to assign IPv6 addresses to customers, and that's harder than just NATing stuff. It's almost like being an IPv6 ISP.
But I've done a toy implementation. To get "anonymous" IPv6 addresses, so I could test VPN service clients for IPv6 leaks, without pwning myself. I needed a little help from an IVPN engineer, but it wasn't that hard.
This thing of having a per-device IP address looks like the wet dream of marketers and those newspapers that won't let you look at more than X articles a month. No thanks.