> Perhaps there is also "firewalling" on the router and the phone can't even have incoming connections. Not sure.

Correct. Every home wifi router worth its salt will firewall incoming connections by default, whether v4 or v6. It's then possible (unless it's some shitty ISP-provided locked down device) to add specific allow rules, or allow all for a particular client.

egress is typically wide open, although sometimes they lock down particular protocols by default (eg. smtp, bittorrent)

> Not sure. In any case, the phone seems to do fine.

That's mostly because a phone is very locked down, can you run an accessible ftp server on your phone?

It's also not windows

Phone OSs tend to pay a lot more attention to security than the crap they put on consumer-grade routers, "smart" TVs and cheap webcams.

I would invest in a proper firewall for the entire home before opening up anything to the world, IPv6 or not.