How critical is the unpatched Nginx resolver vulnerability 3 years later?

The article itself is from (2016), there is an update in 2018 at the top. So .. the headline here is editorialized?