I “inherently” reachable. You can play semantics but the point stands.

> From a security standpoint, it doesn't matter if the IP get translated inbetween. Only the ingress firewall counts

This is complete nonsense. Security is about layers and risk mitigation. You know what is better than firewall rules that can be misconfigured or overridden due to conflict or interface name changes and so on? An IP that can be addressed from global space. Wild!