Sorry I should have made it clear. SIP/RTP don't work with NATs at all (public IP and a NAT'd client) if you follow the spec. By NAT traversal with SIP, I'm referring to this case, not NAT'd client to NAT'd client.

You're right that using relays requires some thought in order to keep it secure.