> route packets to your "private" addresses if that address is in the packet's DST address field

And how does such a packet make it to your router, exactly?

I disagree that it's "the firewall" doing the real work here. If things are configured properly, a firewall should be 99% irrelevant.