UPnP is still disabled by my router and OS, and I won't port forward. If that means some instancing with others will never occur, that's ok by me.
I'm not going to pinhole port(s) for a video game.
I am a security guy, and i use port forwarding. When the game PC is off, yes, the firewall rule/port-forwarding still allows traffic to go over that port to a specific internal IP address which... will be turned off, so no harm done.
Also, I use a custom port - not the default 5001, which by itself with a bit of Google search will clue in an attacker what might be on there. Look for my chosen port number, and you'll find nothing.
uPnP, of course is disabled on both the outward facing router, and the internal one.