> NAT automatically prevents attackers from scanning for and attacking listening ports on the hosts behind it. Given that those who want a service to listen to the Internet should also know enough to forward the ports, I'd say it's a pretty important security benefit and one that has greatly slowed the spread of worms.

So does a few lines of iptables (which work just as well with IPv4), which even most ISP routers that support IPv6 have managed to get right. On the other hand the workarounds for when you actually do want to accept connections through a NAT (cough UPnP) have been consistently misconfigured or had implementations which are simply vulnerable.