A NAT router acts as a firewall.
It acts as a traffic manager for traffic (packets) to and from other machines, either within it's own local network (LAN) or to and from the wide area network (WAN [or the Internet]).
Packets are sent outbound to a specific destination (a 'query'), and correctly configured "reply" packets are directed inbound to the corresponding machine behind the router/firewall, that asked for the packet(s) which are then manifested in the application that made the request (typically a browser, but not necessarily).
Un-requested packets attempting to enter the LAN are dropped.
If you request (with a browser for instance) a file that has malware bundled in it, it will NOT stop the malware; because it would appear as a legit returning file to the router, and be dutifully forwarded to the requesting machine.
They do not have analytic capabilities: just simple flow control parameters.
Routers are however beneficial, as a frontline defense, because they differ from software (on-board) firewalls, in that the former is external and independent of the Operating System; the later within the OS, and if there occurs a corruption of that OS, the firewall can be compromised, unknown to the system user.