Comment by kikoreis

Except NAT is dead simple, and requires basically zero configuration of the CPE from the end-user perspective. Yeah, it complicates (though seldom completely breaks) a host of important applications, but it's hard to think you could replace it with a firewall with an off the shelf configuration and have it work any better.