Public IP assigned to Ethernet Ports

> An employee has an R7800 router [...]

   I've never touched one, so I know nothing, but...

   History?  New installation?  Behavior change in a previously working
installation?

> [...] when a device is plugged into the 4 ethernet ports on the

> router, it is assigned a public IP address. [...]

   Which sort of "a device"?  Is it using DHCP?  Is there a record of
which DHCP server granted that address?  I wouldn't expect DHCP
(broadcast) requests to get through to the WAN/Internet interface on the
thing, if NAT is enabled.  And I don't see a "NAT (Network Address
Translation) Enable/Disable" option in the R7800 User Manual (BASIC >
Internet).

   What about two devices?

   There are some other options which might bypass NAT, however:
ADVANCED > Advanced Setup > VLAN/Bridge Settings.

> This is a bit of a security issue [...]

   More than "a bit", I'd say.

   Knowing what I do, I'd start with a settings reset, and manual
(minimal) reconfiguration.

> [...] A firmware update is due. [...]

   As always, an actual version number would be more useful than your
opinion of what's "due" today.  But different firmware would be an
interesting second experiment.