A private IPv4 worker can initiate an internet connection through a public NAT gateway. The worker stays without a public address. The gateway needs an Elastic IP and placement in a subnet whose route table leads to the VPC internet gateway. The worker subnet then routes its default destination to the NAT gateway.
Those are separate resources and routing decisions. Allocating an address doesn't create a gateway, and creating a gateway doesn't change a private route table. Security-group egress can still block the path after routing is correct. In this lab, assemble the route from known resource identifiers, then trace outbound HTTPS. The final repair keeps the worker private and proves that allowing outbound access doesn't create an unsolicited inbound connection.