Something that I find incredible, but have seen no one contradicting yet, is how when ISPs have started to roll residential IPv6 by default some years ago, they first had no firewall on IPv6 and/or later it was disabled by default (so only few % of users would enable it at best). (Not sure if the situation has changed ?)
Now, IPv6 (when properly implemented, which is another failure mode) comes with much better safety out of the box (like not being able to scan all the suffixes in a reasonable amount of time to find computers on the local network to target), but I'm still impressed that now we seemingly have hundreds of millions of personal computers "directly" connected to the Internet with at best only the OS firewall as protection (when one exists), and it hasn't resulted in major hacking issues ! (yet.)
