Basically...

In a simple dual stack network
we can totally separate IPv4 security and IPv6 security

secure IPv4
secure IPv6
you're done

IPv4 can be NAT'ed, firewalled, whatever
IPv6 should better be end-to-end security
something better than firewall