First, sorry for the late reply. I don't log in often. I didn't consider malware using UPnP. But it seems to me that the probability of malware using it to make a residential IP look like a business IP (e.g. opening up ports for VoIP) is pretty low. But always possible.

I didn't know about FluidStack. Looks interesting. If you have numbers on how many people actually use such a service I would be really interested to know :)