The trouble with destroyNode is that it will rollback all actions at the moment, without checking if it is needed. Say the static nat configuration get implemented and the firewallrules fail. Then destroyNode should return an error because the removal of the firewall rules fails (they are not there).

CloudStack will (should) clean the static nat bound to a VM when a virtual machine is destroyed. The firewall rules might remain, will check that.