I understand how HTTP packets are returned to a device with an internal address behind my router if it initiates a request. (NAT-Network Address Translation reserves a port whose number is sent out and returned.) I don't understand how a request sent to the manufacturer of a device such as a thermostat gets to the thermostat. The device has an internal IP address in the device table of my router but no permanent port (as far as I know). Does the HTTP packet from the manufacturer have the internal IP address of the device in my device table?
It connects to the manufacturers server, queries 'whats my settings' and downloads them. There's no magic here.
There are a couple of ways a device behind your NAT router can receive what otherwise appears as unsolicited communication from the Internet:
UPnP. If your router supports it, the device on your LAN can dynamically configure the router to open an inbound port, essentially configuration port-forwarding to expose the internal device to the Internet
Persistent HTTP Connection. The internal device can establish a persistent connection with a server on the Internet. When the Internet server needs to send a message, it uses the already-established channel.
Polling. The internal device can periodically poll the server on the Internet for new messages. Done frequently enough, this can give the illusion of the Internet host initiating the communication, even though it's the internal device that's doing so.