>25000 devices exposed directly

How does this happen? Doesn’t pretty much every ISP give a router with their modem? How do people manage this?

In ipv4 these will be src-natted and thus have a statefuo firewall by necessity.

In IPv6 they likely will auto configure onto a public ip address which may not have a stateful firewall.