Just because neither one of us can think of a way to do it doesn't mean it can't be done. Not to mention that most people have many more exploitable (Java/Flash/Adobe Reader) options. Anything that affords the ability to just drive by, pop open a port, and setup shop is a definite risk.
True that there's likely things that can be done even if we can't think of a way to do it - I'm not arrogant enough to think otherwise :-). But I'm still of the opinion that if something is already running on the inside of my LAN, being able to open an incoming port is the least of my worries, and pretty much inconsequential, the damage is already done. And since I'm not paranoid enough to deal with the hassle of outgoing port filtering on the router side, well...
Here's a thought. If it really is too much of a PITA to log into a router to open a port...then it's safe to assume that you'll not login to close one either ... So how many port do you really have open, and what are they exposing access to?
I'm running NAT'ed, no "forward all traffic to this host" - for a few well-defined services (http, ssh, minecraft) I have static forwards in the router; that's not too bad a hassle, as it's long-running set-up-once services.
But for short-lived stuff, or things like a torrent client that (for security reasons) randomized it's port on each startup? Nah, can't be bothered. I could live with it if I felt there were any hard security concerns in having UPnP on my home network, but I really don't think so.
Oh, and I'm pretty sure p3lb0x appreciates it as well where he's living - for whatever nazi reasons, our mum doesn't want to give him the router password, so no chance of him adding incoming rules himself :-)
I'm not a gamer so I can't really speak to that but I've never forwarded any ports to my torrent client yet it seems to work just fine.
Well, as long as you're only interested in leeching, and are dealing with well-seeded torrents, sure. But if you want to give a bit back, or are dealing with something where you need the protocol's "tit-for-tat" to kick in effect, you really do want to be able to accept incoming connections, not just initiate outgoing.
Keep in mind I'm only talking small home networks here - I definitely wouldn't want UPnP on a business network or something connecting a public wifi hotspot.