[nagisa]

A border router is not necessary in a typical installation! Its something you only need if you want to do fancy things. Otherwise a commissioner is sufficient (to bring the device onto the network.)

That said, it is entirely up to you how you would configure the system that the thread border router connects to. Thread specification uses local addresses for the thread devices, so in order for these devices to get access out into the public internet you would need to NAT the IPv6 pretty much (or the devices would have to be smart enough to figure out a globally routable IP address, via e.g. DHCP.) At the same time since it is all bog-standard IPv6, you also get full control with firewall rules, NAT/forwarding and such.

Overall you'd need either a very unusual device or a major misconfiguration off the beaten path to get thread devices talking on the public internet.

[Ajedi32]

Almost all real-world Thread networks I'm aware of have a border router in the form of an Apple TV, Nest Hub, Amazon Echo, etc, so I'm not particularly reassured by the fact that the protocol doesn't technically require one.

I was under the impression IPv6 doesn't need NAT. But you're saying they only get unique local addresses, so even with a border router bridging the connection back to my local Wi-Fi network they still can't send packets out to the internet? "They would have to ask DHCP for a real IP first" doesn't seem like much of a barrier.