Agreed with your first point, but not sure about your second - how many of these attacks could really be dented with uRPF? My understanding is the majority are either distributed (coming from multiple ASes) or from compromised accounts in Azure, GC, or AWS.

If uRPF was stopping me from successfully attacking a destination, I would just not spoof. ACLs, uRPF, and anything stateful are still not going to 100% mitigate an attack from a broad range of addresses.