Apologies if this was already mentioned.
There's at least one feature of the new AirPort Extreme base station that's not secure by default: It lets incoming IPv6 sessions straight through. More details here:
http://arstechnica.com/journals/apple.ars/2007/2/14/7063
Noel