I'll take the question from a penetration testing angle.
The biggest downside of running NAT (in its standard configuration) is that you cannot get connections back from other systems and are on a different network(broadcast traffic). In my normal workflow this would stop me using reverse shells or launching spoofing attacks (thing smbrelay/responder).
Kali, like most pen testing distros are not built with security in mind. I would often setup a host only network with SSH enabled and use that to connect to the kali box to perform any testing that required Kali, minimizing the likelihood of attacks against my box and allowing me to use rubbish passwords.
My normal configuration was 1 host-only network and 1 bridged network, just be sure to bind your services to the right ones.