> With IPv6 the entire network is reachable outside by default

Only, and only, if you configured your router that way.

In both cases, it's absolutely the same:

    IPv4 -> allowed NAT ports -> NAT network -> Everything else is dropped/denied
    
    IPv4 -> allowed ports -> directly routed IPv4 network -> Everything else is dropped/denied
    
    IPv6 -> allowed ports -> directly routed IPv6 network -> Everything else is dropped/denied

See?

Of course if you are on someone's else network (typical for hosting when you aren't provided with your own v6 subnet, instead you have a bunch of addresses) then you should configure firewall on each your machine... which is what you need to do anyway?