Opening the ports on the router (or worse, putting adapter in DMZ) should only be done for troubleshooting. You open ports for unsolicited inbound traffic - for example, if you run Web or FTP server on your network. Nothing in phone traffic should be unsolicited.

Some of us are more- or less- security conscious; so different people have different level of comfort opening the ports. But well-functioning phone system with VoIP provider can and typically does run without the need to open the ports.