Upnp is good and it is bad. It can dynamically create port forwarding rules so that your ports are only open when you are using them. The problem comes is the hacker can use this ability to open more place to attack. So the first program gets in say though a email. You machine can not be directly accessed via the internet. So this first program uses UPnP to open ports in the router that allows their internet based server to actually attack and control your machine.
There are/were some actual attacks against some routers themselves that allowed UPnP rules to be updated from internet.
In many cases the devices using UPnP are game consoles which are too simplistic to allow many of the virus/malware things to run.
It tends to...