NAT isn't really the end all be all of firewall. It is trivial and usually default that IPv6 ingress is blocked from external traffic.

Ampere or any other vendor with socketable CPUs.

Thinderbolt? Sorry, stupid autocorrect.

Pretty sure this is just going to be ThunderBolt driven, more or less an external PCIe GPU. You can already run an external graphics card over Thinderbolt, more adapters to do so coming out lately.