Yep.

Of course, some will argue that if the attacker is inside your NAT, you're already pwned.

I don't think that's a very good principle for the security design of internet protocols.