At worst, I see NAT being replaced with default-reject-unless-associated-with-an-existing-internally-initiated-connection border firewalls everywhere a sysadmin with half a clue works.

And that's what I would do (basic stateful inspection), but there are too many organizations (especially SMBs with little/no I.T. staff onboard) who will simply use NAT with IPv6 to get that same end result.

We'd probably be better off giving those people a default-deny firewall and calling it NAT to pacify them. But I doubt that will happen.

I could maybe see Cisco doing such a thing.