This is why we are stuck with huge corporations to provide services to connect to each other. We are sacrificing privacy because we don't want direct connections. We could have hosted an Instagram clone at home as well if NAT wasn't there.

Ability to connect directly does not necessarily mean that you are somehow more vulnerable to attack. There are measures that you can take to prevent attacks from happening. It's trivial to configure.