Supposing I have an untrusted guest VM (e.g. I'm running a cloud data centre). If I set the network connection up to use NAT, the guest can still access the internet. But what's to stop them accessing the host LAN too? How does the NAT handling in the VM host manage to distinguish between say www.google.com (on the internet) and my.local.domainserver (on the host LAN), and prevent access to the latter?
When you configure the network on VMware player for instance to be in "NAT" mode, it'll simply do a "NAT HIDE", in which your host, after sending traffic to the network card, will have his SOURCE IP changed to the HOST IP (this is also know as PAT, port address translation).
If you don't have any specific rules on the HOST firewall denying traffic between vm network and host network then you will be able to access your host.