I'm pretty sure I had read in an earlier forum that QoS does not disable hwnat but I think you are right about the ER being underpowered for this.
In any case, it makes the QoS function essentially unusable in my environment. We have many ERs passing well over 150mbs that have non-radio connected subs that we'd like to provision and had hoped this would be an answer.