Also I don't understand how this works with IPv6 initiative that wants every device have a public IP address. The same goes for IPv4 routers - on many of them you could use the public IP to do the drive-by attack.
IPv6 does indeed complicate things. I suspect we'll end up trying a few things before finding the right answer, starting with a) allowing network admins to configure IP ranges that correspond to the network they control, and b) examining the local network to infer a private range.
Happily(?), IPv4 networks are still pervasive, and this proposal seems clearly valuable in those environments.
