I honestly struggle a bit still understanding how it works, and thinking about it too hard starts to worry grug with fud. Surely it's ungamable with those restrictions 😅
Discussion
Essentially the NAT calculation excludes your own node's clock time from the consensus. This opens you up to eclipse attacks that warp your node's perception of network time.
If you're eclipsed, though, the much more effective attack is to simply withhold new blocks. But that attack would be obvious. Eclipse attacking the NAT time could be a much more insidious long-range attack, potentially causing you to mine an invalid block.
Pretty interesting but a very far fetched attack vector.