Without NAT/ULA (private ipv6 addresses), your devices are routable by default and must be isolated by explicit policy.

Yes, that’s where the basic firewall configuration comes in.

I’m running native v6 at home, with no private addressing (Since it was never implemented right in OSs unfortunately), each system has it’s own public IP address, and even an entirely unsecured device is protected since there’s still a firewall between my network and the internet.