Publish exchange web sites securely

I am implementing Exchange 2013 for a client, The client is very security conscious and I am wondering what are the security concerns with a NAT directly to the Exchange CAS on port 443 for Active-Sync, OWA etc...

I know the recommendation is to use TMG or reverse proxy but can someone explain exactly why and what benefit this gives?

***Don't forget to mark helpful or answer***