This is a university so most likely originally everything was on public IPs but as a result of the IP crunch there was a need to introduce private IPs.
Having the NAT at the network edge means that within the University's network traffic does not get natted. That means that internal connections within the University work just like they did in the old days when everything had a public IP.
Hooking up a couple of NAT boxes to the edge routers and adding source-address based routes to direct traffic to the correct NAT was presumablly the easiest way to introduce NAT at the network edge for traffic sourced from private subnets while allowing the traffic sourced from public IPs to continue flowing as before.
(note: any IPs used in this post are just examples and do not relate in any way to the real network the OPs diagram was taken from, I will assume that they are using 10.0.0.0/8 for private and 220.127.116.11/16 for public)
If the NAT box is attached only to border, there needs to be 2 links between each NAT box and border router, correct?
That probablly depends on the NAT implementation. I'm pretty sure iptables could do it with only a single link to the core router, other implementions may require seperate "inside" and "outside" links.
What you will need for this setup is border routers that can route based on source address (normal routing is based on destination address) so that traffic from private subnets gets directed towards the NAT while traffic from public subnets flows straight through.
Without physical constraints, isn't it better to add links for core <--> NAT <--> border while keeping current core <--> border links instead of attach the NAT boxes to border in the diagram?
I can see a few reasons why the setup they went for may be preferable to the one you propose.
Firstly I don't think you should discount physical constraints. The core and border routers may well be in different physical locations and adding an extra cable between those locations may be expensive.
Secondly I expect doing it on the border routers is actually simpler. If a packet reaches a border router it's headed out of the network. Therefore the border router can have very simple rules along the lines of "send anything with a source IP matching 10.0.0.0/9 to nat box a" and "send anything with a source IP matching 10.128.0.0/9 to nat box b". On the other hand the core routers would need more complex rules along the lines of "send anything with a source IP matching 10.0.0.0/9 to nat box and a destination IP that is not in 10.0.0.0/8 or 18.104.22.168/16 to NAT box a" and "send anything with a source IP matching 10.128.0.0/9 to nat box and a destination IP that is not in 10.0.0.0/8 or 22.214.171.124/16 to NAT box b".
Finally it may simply have been a case of the border routers having the needed features and the core routers not having them. Routing based on source address is a fairly advanced feature.