Also, NAT is a zero-security solution. Get a router with a firewall or assume you are going to be hacked.
Beyond that, any device on the network that is compromised can be used to connect to other devices on the network. The assumption that one can be careless because a device will be in a safe space is not a valid approach to security.