Of course you can do IPv6 magic that hides IPv6 from the end device, but nobody understands how that magic works.

it’s not magic… it’s a firewall, and it works pretty much exactly the same as a NAT: a whitelist of IP and port combinations