IPv6

Basically, with stateful firewalls traffic is disallowed by default unless the thing in the LAN is the one that initiates it. You add exceptions to say oncoming traffic is allowed on certain ports to certain devices.

The only difference v.s. port forwarding & NAT is that you can refer to different devices explicitly off of the LAN, meaning you could host two ssh instances, both on port 22, and have your firewall allow traffic through to both. You can then ssh outside the LAN on port 22 to either device. With port forwarding and NAT, since you only have 1 IP that isn't possible.

The convenience factor is you can say things like, both services run on port 443 and host a web server. Both services get their own IP you can refer too off of the LAN, and you just add an exception to the firewall to let incoming traffic through on those ports on either IP. No finnicking around with reverse proxies pointing to different hosts needed.