It has no built-in authentication mechanisms because forwarding a port typically does not allow any activity that could not also be achieved using STUN methods.
The lack of built-in authentication is due to the fact that port forwarding typically does not enable any activity that could not also be achieved using STUN methods.