It depends on your hardware if it is Debian. Debian prefers to use an older kernel until the next point release comes, which is nice because a random update likely won’t break your system.

But… speaking from experience: expect issues (missing drivers etc.) if your hardware is too new.

The word you are looking for is firewall not NAT.

NAT does not provide security whatsoever. If the NAT mapped your (internal IP, internal port) to a certain (external IP, external port) and you do not have a firewall enabled, everyone can reach your device by simply connecting to that (external IP, external port).

I haven’t seen routers that do not come with IPv6 firewalls enabled by default.