AFTER they have already breached your network, they can already do what they want and they don’t need UPnP anymore for anything.
Communication with the Internet protocol works with IP addresses and open ports. Open ports can be secured or the internet as we know it would not exist.
There is a long thread here: