Are NAT routers good firewalls ?

Most consumer routers have decent firewall capabilities (as a byproduct of their NAT/PAT functionality)... as long as you don't open any ports in them for external access. There is still more that can be achieved by using a true firewall, but in a general sense you are somewhat safe, NAT/PAT is a good first line of defence.

If you do open/forward ports to your clients, the need for a software/hardware firewall to monitor traffic becomes more apparent: NAT simply forwards the packets without any further inspection/verification. SPI, content-filtering and attack logging are just a few of the additional features that a firewall can provide.