Every home router could be built with a default deny inbound for traffic, with big flashing lights saying "do not override this".

IPv6 has private addressing and a form of NAT as well, were it to be the will of router mfg'ers and network admins. No need to stay on a legacy protocol.