How does malware, like the software used to create the botnet that recently DDoS'd Dyn, get past NAT? On a computer, I can see the user can be tricked into downloading untrusted code, or browser vulnerabilities can be exploited. But on internet-connected devices like security cameras, I can't imagine how it would ever connect to an untrusted server without malicious physical access. I'd expect most of them to be behind a NAT router, so how does the malware get in?
A lot of these devices will use Universal Plug and Play (UPnP), a service that runs on many consumer routers and devices, allowing network devices to effectively add port forwarding rules on the router. Many consumers are unaware of this behavior and will thus have their devices exposed to the internet. This is just another example of IoT manufacturers choosing convenience over security.