Orbi LBR20 4G LTE Exposes All Hosts to Internet over IPv6

Model: Orbi LBR20 LTE 

Provider: T-Mobile 

Firmware: 2.7.5.6

Hello, I recently bought an Orbi LTE 4G router using it with T-Mobile but I noticed that when I set authentication type to: PDP-IPv4v6 my internal machines get an IPv6 and are completely open to the internet. Is this expected? My guess is that the router does not do NAT by default when using IPv6? But why is the carrier or router handing out IPv6 addresses? Why would Netgear leave connections open like that without even having a firewall enabled by default. This seems very bad.