A border router is not necessary in a typical installation! Its something you only need if you want to do fancy things. Otherwise a commissioner is sufficient (to bring the device onto the network.)

That said, it is entirely up to you how you would configure the system that the thread border router connects to. Thread specification uses local addresses for the thread devices, so in order for these devices to get access out into the public internet you would need to NAT the IPv6 pretty much (or the devices would have to be smart enough to figure out a globally routable IP address, via e.g. DHCP.) At the same time since it is all bog-standard IPv6, you also get full control with firewall rules, NAT/forwarding and such.

Overall you'd need either a very unusual device or a major misconfiguration off the beaten path to get thread devices talking on the public internet.

Almost all real-world Thread networks I'm aware of have a border router in the form of an Apple TV, Nest Hub, Amazon Echo, etc, so I'm not particularly reassured by the fact that the protocol doesn't technically require one.

I was under the impression IPv6 doesn't need NAT. But you're saying they only get unique local addresses, so even with a border router bridging the connection back to my local Wi-Fi network they still can't send packets out to the internet? "They would have to ask DHCP for a real IP first" doesn't seem like much of a barrier.

Not 100% sure about Thread as I'm more used to Zigbee, but afaik the Thread router acts as either a proxy between your regular network and the Thread devices (you can wrap IPv6 packets so they can be exposed over regular ethernet) or the router is the smart hub itself and the nodes are not really accessible from the Wifi network.

How it works in Home Assistant afaik is that the border router is a piece of software running in docker that has access to the radio, and then HA talks to the thread devices via the virtual network interface of Docker.