Whitehats make money off FUDing you out. That's the reality of it. Let's take an exact look at why UPnP doesn't help anything, to do this, I must put myself in the position of the attacker.

So, I'm all skiddie now, I've sent out my mass-mail worm to millions of machines and there are not-so-bright people out there running 1000-pictures.jpg.exe or the like. They run the worm. Now, it attempts to punch a whole in UPnP... if you've got it enabled. If you don't, it just opens a port uselessly inside your lan. What fun. I can only really connect to the people who now either had directly internet exposed machines or are running UPnP. This is obviously not the best solution as everyone's already FUDed out of running UPnP by whitehats. There must be a better way to do this... Oh yes, reverse connections.

Instead of having me connect to them... let's have them connect to me. This means that, no matter how deeply NAT'd they are, if they can get an internet connection, I can control them because from inside the NAT, it's all just going outbound. Once they're connected to me, the operation can be as normal. And, this means that they don't have to have UPnP enabled at all.

So, now, which of these should I choose? UPnP? or a reverse connection? I think the choice for any skiddie should be a reverse connection. Hell, just grab the latest version of BO2K, there's reverse connection support built right in. That's how easy it is. So, exactly why would I even bother closing UPnP and losing myself the nice, quick setup of my P2P clients to do what?

In conclusion, there is little reason to disable UPnP, it's hardly a threat. I've personally never seen a trojan that uses UPnP, though I have no doubts they exist, I don't consider it a big threat, whereas in order to prevent a reverse connection, one would need to use a software firewall, significantly more painful. Save yourself the pain of manually forwarding your bittorrent client, turn UPnP on.

Oh, and whitehats, next time you start telling people to kill their features to gain security, make sure the security gain can be 100% guaranteed.