> It’s a lot harder to accidentally enable port forwarding on a NAT.

It's probably less than three clicks on most home router web UIs.

But you have to specify not only the exposed port but also the destination address and port which is not easy to do accidentally.

edit: typo

Very hard to make all those clicks accidentally. But anyway I’m talking about pf/iptables rules, not web UIs.