Client-side applications open backdoors everyday through firewalls just as easily as they can through UPnP. If you aren't careful what you click in your browser, you can loose access to your system before you know it. The trick is not letting UPnP be accessible from the external interface... something that should not be an issue in modern hardware. That exploit was found YEARS ago. Companies that deal with internet security had testers on their sites for it even. Hardly anyone tests for this stuff in general though... even a simple scanner like the one at speedtest.net is worth doing ( https://www.speedguide.net/scan.php ). People failing to follow best practices with web apps is the culprit far more often than many realize.