Shouldn't it return NAN?

Possibly it should, but right now it doesn't and the docs confirm that's by design:
Serial.parseFloat() returns the first valid floating point number from the Serial buffer. Characters that are not digits (or the minus sign) are skipped. parseFloat() is terminated by the first character that is not a floating point number.

parseFloat() pulls chars off the buffer until it reaches something invalid - it doesn't have to understand the entire line, merely stop when we reach the end of the float.
Previous behaviour was to have . as an acceptable char in all cases, so:
1 (.2.3xyz in buffer)

1.   (2.3xyz in buffer)
   

1.2 (.3xyz in buffer)
1.2 (3xyz in buffer, . ignored)
1.23 (xyz - end of float)

instead I feel a second '.' should be a break char rather than it being unconditionally acceptable - in essence, 1.2 is the first float in '1.2.3xyz' rather than 1.23.

Proposal and implementation looks good to me. @cmaglie, I think this can just be merged (and ported over to 1.5.x as well)?

This can be resolved with: #3337