But this feels tautological. It's been reduced to "If you want to use NAT with features that only a firewall gives you, then that forces you to use a firewall".

I suspect when people talk about "NAT" in the context of a residential connection, what they actually mean is a "default-deny firewall with connection tracking".

Feel free to replace "NAT" with "the kind of NAT that permits you to share an address between multiple devices" if you feel the need to be pointlessly pedantic about it. The point is that any device that allows sharing a single IP between multiple devices will necessarily implement connection tracking, and will therefore be capable of functioning as a firewall.

(Are you going to point out that statelessly blocking a fixed IP range used to be called "firewalling" so a device without connection tracking can still technically be a "firewall" next?)