they could just firewall inbound connections and have some sort of request/interface to allow certain/all ports whilst keeping everything lovely about public v4 though, yeah?