Parent poster is making the (good and underrated) point that NAT makes this logic failsafe: Turn an IPv6 firewall off and you’ve got all incoming connections allowed. Turn IPv4 NAT off and you’ve got no connectivity at all
So gate it behind a "here be dragons" option or hide it in the GUI entirely for the basic home version.
Or make the "turned off" state block all traffic, just like closing a water valve, or a road gate. I never understood why network firewalls did not default to this.
Tons of firewalls ship with this as a default logic, it doesn't require NAT in the slightest.