At one point I had an entire /24 routed over a 28.8K connection. I eventually upgraded to an ISDN line. Fun times.

It sounds like what you really want is a firewall, not NAT. Having a globally unique prefix (either IPv6 or v4) does not mean your network is completely accessible externally. There are no dependencies. It actually makes things simpler if you ever want to connect two internal networks.

Of course I want a firewall. We all do. That much was obvious even when I was on dial-up, installing Shorewall or whatever it was back in 2000.

My point is that if you have a firewall you're in the exact same position as if you have a firewall+NAT in that you need to be able to punch holes in it.

IPv6 on its own does nothing to help with this.

NAT make hoke punching more complicated (or depending on exact type of NAT impossible)

What is the downside? The external network only needs to know you're responsible by an IP range that your ISP gives you, you can still configure your network internally as you please.

The addresses depend on the external network. If my prefix changes with IPv6, suddenly nothing works on the internal network until all the nodes are reconfigured and the firewall rules rewritten. I know because it happens to me regularly.

With NAT the internal nodes can for the most part work like normal. They might experience a gap of a few seconds where communication with the external network (the Internet) is down, but apart from that nothing.

You might say just use ULA[1]! To which I will say what's the point of IPv6 then?

[1]: https://en.wikipedia.org/wiki/Unique_local_address

It's true that this is a problem for intermittently connected consumer networks and customers of flaky ISPs that change the prefix on you needlessly. Regulation for allocating PI space to flaky isp customers might help.