We have a single router (4331) that connects to our ISP. We do PAT (dynamic nat) to give users internet access. Now typically we'd have an OUTSIDE-IN ACL that blocks traffic from the internet. My question is, if we're using PAT and have no static 1-to-1 translations, do we even need an ACL? If yes, what would be the attack that an ACL would prevent?
Your router itself needs protection. Any traffic coming into the router for the router address that is not part of the NAPT (see RFC 2663, IP Network Address Translator (NAT) Terminology and Considerations, PAT is a misnomer for NAPT) will be handled by the router. An attacker could try to take over the router on standard protocols (telnet, HTTP, NTP, etc.). If you log access attempts on the ACL, you will see a lot of automated attempts to compromise the router.
Don't confuse NAPT with security. Your router needs to be secure. If your router is compromised, it doesn't matter if you have any version of NAT for your LAN, the router has full access to the LAN, and anyone controlling the router will have full access to the LAN.
Your LAN needs to be protected by a firewall (either a separate device, or a software firewall on the router). NAT is not security, and your are making a mistake if you assume that.