When you setup your Nest, you create an account for it and sync your devices to the account. So all the information tying your app to that particular device is saved in a Nest database somewhere on their servers. In your scenario you're asking how the Nest passes through your firewall to see what your account settings have told it to do. Your phone app can't always be on the wifi to talk to the device directly (and that would somewhat defeat the purpose of it) so UPNP doesn't come into it.
It doesn't look like Nest specify which protocols they use on their site - but there is nothing stopping it from using HTTP/HTTPS to connect to your Nest account once you've put it on the Wifi. Just the same as when your friend asks you for your wifi password - no Firewall rule changes required for them to go out to the internet once you give it to them.
Nest's own Support documentation advises that Firewall issues are still a problem.
Is upnp absolutely required to have network devices that can.be connected to from the wan?
UPNP isn't even mentioned in the Nest support documentation. UPNP is for connecting within a network, not going out to the internet. So would be useful if you had multiple Nest devices and they had the ability to talk to each other within the Wireless Network - say if your thermostat and camera could work together to determine if there was a fire - but not for talking to your app on your phone.
On an Asus router running Merlin, how do i find whats configured so that I can review it?
You could review your Firewall settings but assuming its already working, try installing Wireshark to monitor the outbound traffic coming from your Nest device.