It depends.
-
Certain devices will ask the router for an outside connection through protocols like UPnP. Not all routers will comply to the request, but a lot of cheap consumer grade ones do.
-
Devices with IPV6 support get a publicly routeable IP by the very nature of the protocol, so if careful firewalling of the services isn’t done, these devices can be exposed.
-
Many “cloud” products are designed around communicating out to servers for their day to day operation. Compromise the company servers, and in turn you can compromise the individual IoT devices.
Aside from those case, yes you are at least “safer” with the devices behind a router.
