Any given layer of security can be breached with expense and effort.
Breaching every layer of security at the same time is more challenging
than breaching any particular one of them. The use of NAT adds a layer
of security to the system that is not otherwise there.
Think of it like this: you have a guard, you have a fence and you have
barbed wire on top of the fence. Can you secure the place without the
barbed wire? Of course. Can an intruder defeat the barbed wire? Of
course. Is it more secure -with- the barbed wire? Obviously.
Bill-
In a security context, NAT/PAT only provides *obfuscation* of the internal numbering and source ports of the networks on the inside of the NAT/PAT device. "Security by obscurity" is a well debunked maxim by now. Any perceived benefits that obscurity provides are gone as soon as the information attempting to be hidden can be discovered, or the methods by which it functions are known. It may slightly deter the lazy, but techniques to discover the otherwise 'hidden' numbering and port usage have existed for decades.