I disabled it after this post, but it appears Plex switches to 'indirect' mode (it goes out to the Internet and back in) without it; i.e. I am using UPnP.
It's not clear what the solution is - update firmware? I am on the latest. Use OpenWRT (or whatever it's called these days)? Every time I look into it (I really want to!) I stop at the simple 'I want to do this, I will happily buy a new router, which one do I buy and know it works well and will continue to work well with updates?'
Plex has had a major forum breach for basic user data including IP addresses [1], around the time of the botnet's first discovery in 2017, which has me greatly wondering if Plex may have been an inadvertent bootstrap vector for this attack?
UPnP wouldn't exist without NAT. The underlying root cause of UPnP is NAT (and the slow deployment of things like reliable mDNS implementations). Admittedly, Plex would have different security problems without NAT, given its model, but arguably those security problems would have simpler solutions in a world without NAT.
It's not clear what the solution is - update firmware? I am on the latest. Use OpenWRT (or whatever it's called these days)? Every time I look into it (I really want to!) I stop at the simple 'I want to do this, I will happily buy a new router, which one do I buy and know it works well and will continue to work well with updates?'