I'm still vehement that #1 & #2 are wishful thinking (security through obscurity... better to drop all packets, or simply not use a public address; ULAs are fine IMHO), but perhaps something as simple as a prefix-aliasing notation would allow easier internal referencing and address #3. For example, MY_NETWORK:1. That can be done with shell/environment variable substitutions before using them, but it would be nice to be able to count on IPv6 applications to accept something like that for networks in the routing table... (might require a prefix-naming RFC, so a name can come with a router/prefix advertisement and/or the ability to store name-to-network prefix mappings in DNS SRV, or similar, allowing internal or global users to find the right host on the right network...)
That said, truly global addresses with service registries like DNS/mDNS, etc, remove the need for immutable (staticly-assigned and hard-coded) addresses entirely, albeit at the expense of registration and lookup.
#1 - You don't expose any internal hosts addresses to the external world, everything comes from a single external host.
#2 - No route back to the hosts inside the lan. If they can't route to you, they can't attack you. (Not really true, but it does make it more challenging to mount an attack from the Outside -> In. )
#3 - You can change ISPs without any internal renumbering required. Unlike with IPv4, getting provider-independent IPv6 space can be challenging.
IPv6-to-IPv6 Network Prefix Translation (NPTv6) might be a happy middle ground that solves #3, but still leaves you mostly exposed on #1 and #2.