I am a bit confused about NAT gateway.

NAT gatway is used when an instance in private subnet needs to talk to public internet, like for downloading a software patch. NAT gateway is said to allow only outgoing traffic. But if that’s the case then how would patch be downloaded as it would need incoming traffic from public internet, isn’t?