They probably meant to say that most were behind a firewall. NAT is not any sort of particular protection against anything. Because NAT almost always comes with a firewall there is a tendency to conflate the two things.