I am facing a serious conundrum (to me at least). Whether or not to disable UPnP on my network. I understand the risk, an infected computer could punch a hole in my firewall, and more infections can follow. I would disable UPnP, but the people who are on my network are not really savvy enough to go to the router IP, and set up a forwarded port so their stuff will work. But they has pretty safe browsing habits. No clicking on weird links, or "You won" buttons. (uBlock has really helped this, except on phones). Antivirus on all Mac/Windows devices, android and chromebook everywhere else. I am not always able to do network stuff for lengths of time for a variety of reasons.
So as the title says, just how much of a risk would I be put on this network by leaving UPnP on? (This is not a business network, running servers that connect to the outside world, just a simple network for a few people in a building.
Bonus: I just realized UPnP has been running on my router for at least five years, and nothing has happened yet. I know that nothing in the past does not mean nothing in the future, but I thought I would mention it.