[throwaway09223]

> I‘d be surprised if that’s true for most operators.

It's true for the operators I've tested so far

> On IPv4 you’ll be behind carrier-grade NAT (so no inbound connections)

Sometimes, but often still not the case.

> on IPv6 (including NAT64/DNS64), successfully guessing somebody‘s IP address seems extremely unlikely

Guessing a specific person's ip is a very different threat model from being hit by a random scan.