Well, I agree that NAT is not proper security, but at least it provided a second layer on top of the incompetence of your average IoT developer.

The so-called smart devices doesn't follow the standard security protocols anywhere close to computers and mobile devices.

Host discovery in IPv6 is a harder problem due to the huge address space, whereas with IPv4 I can sweep the entire v4 address space in maybe 30-60 minutes for a port of interest.

Scanning the whole address range is difficult but due to the methods used to generate and acquire ipv6 addresses, there are methods to find assets.

https://github.com/lavalamp-/ipv666

The consumer routers I have experience with still apply a stateful firewall to IPv6 traffic.

> but this has been the norm for customer IPv6 for years now

Is it? Don't most consumer routers come with a firewall configured to block incoming IPv6 connections?

Maybe brand new ones do (?), but the ones I've used in the past few years don't seem to (they have no way to configure it).

This is in the context that those ISPs are boasting 90%+ IPv6 coverage, which makes up for tens of millions of residential customers !

Are you sure? Because these boxes typically don't provide any (good) tools for configuring their IPv4 NATs/firewalls, why would you expect them to provide tools for managing the newfangled IPv6? IPv6 support in a lot of routers is pretty lacklustre, but I've never seen one so incompetent that it doesn't at least block inbound traffic by default.

Because the ISPs at the same time do provide tools to configure them for IPv4, and they're the ones boasting about connecting « everyone » to IPv6..?

Otherwise, this is more hearsay from discussions about this on technical ISP forums, I wanted to look more into this, but I'm waiting until my ISP gives me more than a single /64, and with proper router support (so I can easily do things like host my server separate from my home network).

> Because the ISPs at the same time do provide tools to configure them for IPv4, and they're the ones boasting about connecting « everyone » to IPv6..?

My point was more "The tools they provide for IPv4 are crap, so wouldn't you expect the tools for IPv6 to be crap too?" with a side helping of "Just because they don't show you any (good) UI doesn't mean it doesn't exist". I agree that ISP-provided routers suck for both IPv4 and IPv6 configurability, maybe a bit worse for IPv6, but in my experience I've never seen one that both enables IPv6 by default and allows inbound traffic.