Agreed. Assuming an AWS "NAT Gateway" is the same as a regular NAT?

Security is not the purpose of a NAT. It's there to give you more IPs than you have. There's all sorts of NAT hole punching techniques. If you want a firewall, you need a firewall.