Connecting through wifi adds the benefit of being behind NAT. Why do cellphones not simulate being behind a nat network when connecting directly to the internet to limit the attack surface? Or, is there software that has implemented this?
NAT does not explicitly add security. It only implicitly adds security because it needs to keep a state for all outgoing connections to map incoming packets back to the originating connection - and thus implicitly denies any incoming packets which don't match an outgoing connection. But, this security can already be done with a stateful packet filter (like iptables) which is usually the base for a NAT solution anyway.
But, this kind of security is actually only needed to protect services on the phone which accept packets from outside even though they don't expect such packets. This means services which bind to any address instead of only the localhost address. Usually there are no such services, i.e. either they bind to localhost only or they actually expect traffic from outside.
That does not mean that such a packet filter is not useful on mobile devices. It actually is very useful because for example on a rooted Android phone you can use the builtin iptables with a nice interface (such as Android Firewall) to limit which applications can access the local network, use WLAN, use mobile data or even can be used with roaming.