It is worth recognising that the vast majority of attacks these days, particular on home connections, are as a result of user-executed malware e.g. opening infected binary attachments received by e-mail, downloading dodgy software from the Internet, indiscriminate use of memory sticks and other removable media and inadvertently running malicious code on visited websites etc.
Given this there is very little a stateful firewall can actually do. We must therefore be very careful that we don’t focus on the wrong problem - just because we’ve lost the inherent stateful restrictions of an IPv4 NAT doesn’t necessarily mean we are any more vulnerable.
All that said, whilst the majority of attacks might well be at the application layer, the majority doesn't equal the entirety and so there are still some prudent steps that ought to be taken to protect elements of the network layer and also to help shield some of the more common applications/services from attack that might be vulnerable in their default or otherwise badly configured state.
To that end there is a draft informational RFC published under
draft-v6ops-vyncke-balanced-ipv6-security-01.txt that proposes such an stance as a default CPE configuration. It is based upon a real IPv6 deployment (Swisscom) and claims to have resulted in no known security incidents. Of course, security is an arms race and methods of attack are an ever-moving target so such a configuration would need to evolve to suit the changing landscape but as a general principle I fully support it.
Again though, the real issue is malware and mitigation of that threat lies almost exclusively in user education and
host-based security.
