Comment by Dagger2

We haven't forgotten that, but we're also aware that non-IT people can't run NAT either. They can plug in a box that already has NAT configured though, and if they can manage that then they can also plug in a box that already has a firewall configured.

VMs work fine without NAT too -- DHCPv6-PD lets the VM software automatically request a routed prefix.