As far as consumer routers go, wouldn’t it be trivial to re-tool the usual port forwarding interface to simply accept connections to a specific address-port? That combined with a internal block-all-inbound rule would be quite hard for a user to footgun themselves horribly with.

From a quick search, UPnP seems capable of automating this for user convenience, especially with stateless addressing.