In more detail
The router remembers which internal device opened each connection and sends replies back to it. NAT slowed the exhaustion of IPv4 addresses and incidentally blocks unsolicited inbound connections, but it is not a security feature in itself. IPv6 has enough addresses to make it unnecessary.