You do not define the terms, i.e. the concepts, but you give examples and explain what those examples do. I think here lies our misunderstanding. You explain all real things that I know very well for years. For example you define NAT basically as Linksys or other "simple NAT router". Apart from the fact that even those "simple NAT routers" have huge differences in functionalities they provide, the concept of NAT is not defined by some products available that my use it. The same way you mix the concept of a firewall with NAT and proxies services as they may appear together in real devices.
If you do not understand the concepts and are able to differentiate and in particular see the various concepts seperated from each other, you are not able to fully grasp the meaning of it because you only consider for example a Linksys BEF as a NAT router when it is actually a combination of various concepts.
A proper security design (which certainly requires several step before you sit down and think about the security concepts you want to apply) when you apply these concepts properly to your scenario you achieve the best possible security. For example, to seperate two networks and allow only specific traffic in between you require a packet filter. Your example "NAT device" does packet filtering, too. In drops in-coming packets if it does not know what to do with it. If it finds a use it forwards the packet. The important thing is to understand the concepts.
The step after that is to do the implementation of your security design by looking for suitable solutions that provide the necessary means to do what you want it to do.
Even if it often seems simpler just to say "like a Linksys", in particular in the "NAT router" area the collection of many different concepts in a single device plus a marketing department that just uses terms as they sell not whether they actually apply, often result in big confusion. And I think that is very unfortunate but there is little you can do about it. But as someone who designs security systems you have to know and differate between concept and actual devices. If you only think about some 10 different devices and how to plug them together to make your system secure, then your design is flawed from the very beginning.
So, to come back to the issue of private vs. public IP addresses. Neither one is more or less secure per se. In both cases you apply packet filters that filter traffic between "inside" and "outside". Private IPs require additional mapping of connections between internal and external IPs. The only time it makes a difference is when you don't put in a NAT for your private IPs but a normal router at the edge of your network which just drops private IP traffic. But in that case your computers with private IPs cannot access anything outside your network because of their un-routable private IPs. But we were not considering this case...
Gerald