It is not the address translation mechanism that does the protecting but rather the state tracking.
Until very recently I was with an ISP with IPv6, and things like my home printer had IPv6 addresses—but just because they were globally addressable did not mean that they were globally reachable.