For corporate clients that you don't want on the internet, firewalls which are no less complicated to configure than any NAT setup, can be used.

This statement leads me to believe you've never looked at a corporate firewall policy, much less an actual ruleset. I've seen a few dozen, from medium to large enterprises. And I can't count the number of times I've seen rules that would leave them wide-open were it not for their NAT to a private address space. In all cases this was accidental, as it left some number of internal hosts exposed. However, it had slipped through because of old rules or some typo.

Current routing hardware can handle it just fine.

I'm not so certain of this. However, I'd like to see the information you are basing your assessment on.

A decade ago, the internet was made up of peers.

Yes, and the traffic (and security threats) were trivial compared to now. That's why I'm saying that an IPV6 migration requires very careful consideration.