absolutely unbelievable (even by the very low standards I see, being in iot myself) that any commercial equipment would be doing upnp

someone manually poking a hole in their firewall is way more likely