And that makes sense. The security scope of "my home" makes a lot of sense. I want every computer in my house to print on the printer without extra authentication. And the tiny CPU in smart doormat can probably be overwhelmed even by a tiny DOS attack.
And the advanced people would not buy switches as well, as they’d want some sort of dedicated firewall/IDS box.
As I read it, it’s a little narrower than that. This attack allows someone to open up an unexpected port on your NAT gateway back to one specific host - the machine that ran the attack code in its browser. It, on its own, doesn’t get you to all the other hosts like the Smart Doormat or the IoT oven. (Though there’s a reasonable chance this gives the attacker, say, a redis port on your box, which gives them root, which then allows them to attack your doormat from there...)
Two reasons: 1) This attack is mostly built off the complexity that NAT requires. STUN, TURN, ICE, ALG all exist because of NAT. More complexity == harder to secure. 2) The actual goal of the attack is to allow sending packets to hosts on your network. The only reason this is even considered an attack is because treating NAT as a security layer leads to the neglect of other security aspects. It shouldn't be a problem for your smart doormat to get random packets, but we've been allowing vendors to get away with shipping devices/software that's only safe on a 'local' network for decades.
Maybe I'm wildly optimistic but if ipv6 had been the default for years and every random IoT device was expected to be exposed to the public internet by default, maybe we'd actually have something approaching decent host-level firewalling/etc by default too?