Could you imagine the bot armies if every IOT device was NOT behind a NAT?

Why? Firewalls have been around since before 1994, when Cheswick and Bellovin literally published the book on firewalls:

* https://en.wikipedia.org/wiki/Firewalls_and_Internet_Securit...