In more detail
The router remembers which internal device opened each connection and sends replies back to it. The usual home form also translates ports (often called PAT or masquerading): each outgoing connection gets its own public port, so one address can carry thousands of connections at once. Some providers add a second layer, carrier-grade NAT, using the shared range 100.64.0.0/10. NAT slowed the exhaustion of IPv4 addresses and incidentally blocks unsolicited inbound connections, but it is not a security feature in itself. IPv6 has enough addresses to make it unnecessary.
Why it matters
A game server, camera or home server behind NAT cannot be reached from outside unless the router forwards a port to it, and behind carrier-grade NAT even that is impossible. Websites and logs see only the shared public address, so every device in the house looks like the same visitor.
Example
inside public destination
192.168.1.20:51515 → 203.0.113.7:40001 → 198.51.100.10:443
192.168.1.21:51515 → 203.0.113.7:40002 → 198.51.100.10:443
Both devices used the same local port, so the router gives them different public ports. A reply arriving at 203.0.113.7:40002 is sent back to 192.168.1.21.