Feel free to replace "NAT" with "the kind of NAT that permits you to share an address between multiple devices" if you feel the need to be pointlessly pedantic about it. The point is that any device that allows sharing a single IP between multiple devices will necessarily implement connection tracking, and will therefore be capable of functioning as a firewall.

(Are you going to point out that statelessly blocking a fixed IP range used to be called "firewalling" so a device without connection tracking can still technically be a "firewall" next?)