I am confused by this question, if you forward a port then the only device you should be interested in is the device you are forwarding to surely? If you are worried about devices on your network, then surely since they are already on the network side of the router and so if they were going to do something nefarious then opening a port is the least of your worries.

Honestly trying to understand the point you were trying making.

and, even if you scan them, how do you know that a port knocker isn't there waiting to the secret knock?

Opening a port on consumer routers does not mean that all devices are open. Normally you forward a port to a host+port in the local network. In most cases some server which you control. All other devices are not affected by opening a port.

This doesn’t really apply if you’re port forwarding to a specific device. In that case you know that you have told your firewall to forward port 80 & 443 (for example) to your web server and you know what ports that has open. I would not be using UPNP on the other hand as that seems dangerous especially in the IOT era.