Well, one of the advantages of P2P is you don't get the "lag" (that isn't really the right word for it) you sometimes get with client/server.
Not true. You actually have a vastly worse problem because with P2P you have to worry more about synchronization. If you're server-centric, things "happen" when they reach the server, and they are implicitly serialized. In P2P things happen, when? (example: my client gets a message that I've suffered damage. my cheat-layer triggers my SCB, then allows the damage message through. it is impossible to tell whether I just had perfect timing on the button or if I am cheating)
Here's another hint: in a server-centric model you can tell when one of the clients has disconnected - whether it's "combat logging" or network error. You can also tell if there are intermittent bandwidth problems. That opens up a host of new possibilities such as gracefully dropping someone out of an instance if everyone else in a dogfight has 11ms packet round-trip times and one player has 110ms RTTs. You can tell the sync state of a fight. uPnP also uses UDP (which is really stupid) so as to guarantee that there's no possible way of detecting if someone has disconnected or if they are actually getting any traffic or if traffic is getting discarded due to load at an intermediate point.
Bandwidth and performance can have absolutely nothing to do with the problem.
Nobody who cares about bandwidth or performance would use uPnP for anything. That's remote procedure calls encoded in SOAP, which is XML over HTTP - talk about overhead!! I'd be surprised if the messaging overhead from all that glarp weren't more than 100% of the message size (especially with small messages like pewpewpew and location/heading/etc)
uPnP also has some gratuitous built-in limitations on the number of connections possible. Rather than thousands, Microsoft cleverly limits the number of connections to around a dozen. Because Microsoft is the god of bad networking protocols.
One big advantage of using uPnP, other than that it breaks constantly when it encounters firewalls, is that it leaves your endpoint open to hundreds of denial of service attacks. That sure is some great networking choice, there, FD!!!!
Ancient games like X-wing VS Tie Fighter, or early versions of Unreal Tournament got this right: you pick a system that's willing to "host" the game and use it as the multiplexing node. This was, what, 1997 or so? FD just didn't do their homework and used the choice of least resistance, which happened to be about the worst choice they could have used. The only thing I could think of that would have been worse would have been to use Google Spreadsheets as a rendezvous/server architecture. That would have been more secure, actually, and the overhead would only be about 3x as bad as uPnP... And that's saying something.
Edit: I just did a bit of back of the envelope and using google docs wouldn't be substantially more inefficient than using XML/SOAP over HTTP like uPnP does. Incredibly disgusting coding, FD!