VPN's also have vulnerabilities as you say. Ports are there for hosting applications.
In the future v6 will probably replace the need for NAT anyway.
I do agree devices aren't open enough to know about any vulnerabilities.
When they sell there kit there not interested in patching like the rest of the IT world, they move on.
I think more needs to be done from the manufacturers end.
Here's that blog