Yeah it's a huge source of problems. If you are outside the US your IPv6 prefix is never gonna be correct in every GeoIP database, even if you send a request to have it corrected, so you sometimes get geoblocked and other sites just block you because it sometimes gets classified as VPN.

Given how large the address space is, it's super easy to segregate out your networks to the nth degree and apply proper firewall rules.

There's no reason your clients can't have public, world routeable IPs as well as security.

Security via obfuscation isn't security. It's a crutch.

That's what temporary privacy addresses are for. Clients can just keep generating new addresses in your /64, which is it's own subnet.

Obfuscation is not security, and not having IPv6 causes other issues. Including some security/privacy ones.

There is no problem having a border firewall in IPv6. NAT does not help that situation at all.

This article is biased to selling you more F5 equipment but is a reasonable summary:

https://www.f5.com/resources/white-papers/the-myth-of-network-address-translation-as-security

Long story short is that NAT is eggshell security and you should be relying on actual firewall rules (I wouldn't recommend F5) instead of the implicit but not very good protections of NAT.

It wasn't designed for a security purpose in the first place. So turn the question around: why does NAT make a network more secure at all?

The answer is that it doesn't. Firewalls work fine without NAT. Better, in fact, because NAT itself is a complication firewalls have to deal with, and complications are the enemy of security. The benefits of obfuscating hosts behind the firewall is speculative and doesn't outweigh other benefits of end to end addressing.