[akerl_]

Given that you get a stateful firewall as a facet of NAT, the main risk would be if your edge device was listening on the external interface with vulnerable services.

I appreciate the level of specific engineering that goes into purpose-built firewall distros, but "locking down" a device whose sole function is to perform NATing for a network is not terribly complicated.