Or my predecessor/address space neighbor, or that of somebody using my wireless hotspot once, or that of me clicking a random link once and connecting to 671 affiliated advertisers's analytics servers...

I think a default policy of "no inbound connections" does makes sense for most mobile users. It should obviously be configurable.