It's in a nearby comment chain, but apparently my understanding was outdated and/or just incomplete. The SLAAC privacy extensions will make use of a full /64 prefix instead of a device specific one. That makes it functionally equivalent to NAT if and only if addresses are rotated on a very frequent (ex per browser tab) basis. (I wonder if you could rotate per origin within the same tab?)