“As such, customers that have chosen to not require or implement RFC 7606 have done so willingly and with knowledge of what is needed to defend against these types of attacks.”
One malformed attribute can ride through routers that don’t understand it and reset BGP sessions on the ones that do, again every time the session comes back. A fuzzer found it in Juniper, Nokia, Extreme, FRR and OpenBGPd. Nokia has no plans to fix it, and Extreme blamed its customers for not enabling a standard Extreme itself does not support. No vendor offered a bug bounty, so a self-employed researcher did the security work for free and then had to warn the vendors’ customers personally.