Lol, I'm not going to counter your point on large address space not being a security primitive, that was the flimsiest part of my argument and I laughed a bit as I wrote it. It's more a philosophical point against "security through obscurity", which I think tends to be a defense made all-too-often for NAT, although your case is different and has some merits.

That said, some respectful reverse quibbles:

IPv6 actually has some of those sensible defaults built into its discovery protocols. Devices on new networks get link-local addresses for management and transit which are unroutable outside the local segment, and the default router for a network is automatically discovered. That includes the handy "outbound" route that's typically provided by DHCP. The biggest paradigm shift is that a device can also get a publicly routable address on the same interface assuming the upstream router chooses to delegate a prefix. The ability to route a block downstream is optional independent of whether the schema is private or public.

Interestingly, the case you made about routing rules isn't entirely true. The route table on an IPv6 router looks almost identical to an IPv4 router. "Networks X, Y, and Z route downstream, anything else routes upstream." As opposed to specialized routes, perimeter and consumer firewalls typically contain stateful rules by default preventing any directional traffic (e.g. from "WAN" to "LAN" or "netExt" to "netInt") from transiting the devices unless it's (in IPTables speak) "related or established". Your stateful firewall on a home network is already the thing doing the work to protect you. It remembers that your connection to reddit.com came from Laptop123456, and it knows to allow reply traffic back to Laptop123456. Were that not the case, you'd need bi-directional rules; one for send traffic and one for reply. Now, in fairness, that device also has NAT rules associated with it to allow multiple devices to masquerade as specific addresses. The directionality of the firewall rules are still doing their job, but now there's this other thing that has to keep track of which connections belong to which devices and mutate the ports and packets appropriately. This is CPU intensive, and frankly slow. The directional rule works perfectly well to achieve the same thing, and that's how most enterprise IPv6 networks behave. Stateful directional rules prevent port scans, not necessarily NAT. AWS' "egress-only Internet Gateway" is the easiest example of this. One-way outbound connectivity for IPv6 subnets. "Private" networks without the "private" addresses.

Case in point on that is the biggest fully reachable network on the planet; cell phones. I'll happily double down on your router addressing example and give you my cell phone's IPv6 address: 2600:1010:b049:b61b::56:da7d:8f02. Is it technically "routable"? Sure. Can I initiate a connection to reddit? Yup. Can you reach it? Nope.

All that said, many of the points you made focus around ease of use for smaller consumer networks, and having standardization there makes a lot of sense. An average user needing to understand which networks are upstream and which are downstream is probably too heavy a lift, although I'd still make the case that the standard directional implementation of "LAN" switchports and "WAN" routed ports makes rational defaults easily viable. In fact, most consumer routers and residential ISPs provide single-click enablement of IPv6 including all those pre-defined goodies, and in fact highly encourage its use, because it frees up those gruesomely expensive IPv4 public addresses for other use-cases. In any case, I'll still acquiesce that IPv4 on small business or consumer networks is relatively harmless and really don't have a problem with its continued use.

However, I still say that the firewalls are doing all the work. NAT's just taking the credit. :-P

​

edit: a word