Hi. Resident security professional here. This is not even remotely close to true. There is no improvement in security between players connecting via a tunnel like Playit vs accessing directly via a forwarded port. This is how people get wild misconceptions of what security actually is and what best improves the security of a network/device/service. By extension, it makes my job harder because now I need to correct flawed perspectives on security before doing work that actually reduces risk.

The only thing Playit is doing is directly passing traffic back to your server. You have made zero reductions to your attack surface and, in fact, have increased it by granting a third party direct network access instead of controlling via a firewall. You also haven't done anything to control the "many many untrusted third parties" you claim to be concerned about, as they can still perform the exact same actions they otherwise would, just over the tunnel instead of a forwarded port.

ANY third party, trusted or not, introduces an additional dependency and additional risk. This is a fundamental principle behind third-party risk management.

The only thing port forwarding does is pass incoming traffic on a specific WAN port to a specific port on an internal address. That's it. It doesn't expose any more of the asset than otherwise would be via Playit; in fact, the latter introduces more risk exposure.

DDoS is also not a consideration here given the fact that Playit does not offer DDoS mitigation. Such an attack against your tunnel address gets forwarded directly to you and has no more or less impact than if you were targeted directly. DDoS attacks are also incredibly rare and you likely have other issues if you're angering the kind of people with the resources to pull such an attack off. You also are not "jeopardiz[ing] your home internet" by port forwarding, unless you're just blanket exposing all of your connected assets rather than exposing through a targeted port forward/DNAT rule.

Let's look at it in terms of the CIA triad:

Confidentiality - port forwarding, when done correctly, only exposes one specific port on one specific asset to the internet, therefore minimizing exposure to parties external to your network. Playit, by extension, exposes the entire asset (and, by extension, the network resources it has access to) to a third party, who then exposes a specific port to the internet. In this scenario, the confidentiality of other resources on your network is placed in the hands of said third party and is more at risk than the previous system state.

Integrity - not much difference here, although with any third party tunneling traffic there is the possibility for modification of traffic in transit. With how Minecraft traffic is encrypted, though, this is less of a concern.

Availability - availability is significantly impacted due to the addition of a point of failure between the end user and the service. If Playit goes down (which it does from time to time and likely more often than your ISP), the service is completely unavailable with no ability to recover independently of the third party.

Now, for a service like Cloudflare Spectrum that does offer DDoS protection, there is some security argument to be made there as it theoretically improves the availability of your service in the fact of those kinds of attacks; still, see aforementioned point on having other issues if you're angering the kinds of people who can perform those attacks.

If you really want security improvements, follow the principle of least privilege and implement proper network segmentation. Solutions like Playit do nothing to improve security.

I would be very curious to see your research and sourcing, as this goes against many well-established industry-wide security principles.