The NAT firewall will stop the person who tries to connect to your machine from outside, to do nefarious things. That's good.
Correct. It stops things over which you have no control.
It won't stop the smarter hacker who conceals some software on a website. You visit the site, you download the software, it installs on your PC, and you know nothing about it.
Correct. It doesn't stop things over which you do have some control. (Personally I choose not to visit dodgy websites and download and install and run viruses, but I realise that others make other choices.)
All I was saying was that a typical broadband installation is, by virtue of the stealth mode NAT router, more, rather than less, secure than a typical dialup installation. I made no claim that the NAT box stopped everything. Nobody has made any attempt to contradict this.