Setup a raspberry pi with an IPTable rule to log and black hole all incoming traffic, then open it up entirely to the internet through your router.

I did this and, after about 48 hours, had a nice long log of bots hammering the server scanning for vulnerabilities on open ports.

I imagine non-technical users (the ones at a high risk of getting malware just browsing online) and wonder if they are truly better off if we open up their computers to the world without first rethinking the security model.

It matters when port forwarding is impossible because the user lacks a unique IPv4 address. Earth has 7 billion people and 4 billion IPv4 addresses, so carrier grade NAT is inevitable.