I know whoever was in charge of configuring Dockers iptables routes should have known this and messed up, but that is fucked up.
If you set up:
net.ipv4.ip_forward=0
net.ipv4.conf.eth0.forwarding=0
net.ipv4.conf.docker.forwarding=1
My guess is that the real real story is probably that every guide on the internet says to just set net.ipv4.ip_forward=1 and that nobody bothers to stop and read up on the sysctl parameters they're copy/pasting from the internet.
For this attack to succeed, the attacker also needs to be on the same network or have their upstream ISPs accept plain external traffic towards internal networks. Executing the PoC on Linux without being in the same subnet won't even be accepted (though raw sockets may still send out traffic towards the host that will probably get filtered somewhere along the way).
# sysctl net.ipv4.ip_forward net.ipv4.conf.enp8s0.forwarding net.ipv4.conf.docker0.forwarding
net.ipv4.ip_forward = 1
net.ipv4.conf.enp8s0.forwarding = 1
net.ipv4.conf.docker0.forwarding = 1
# docker run --rm alpine/curl -sI --max-time 5 http://1.1.1.1 | head -n2
HTTP/1.1 301 Moved Permanently
Server: cloudflare
# sysctl net.ipv4.conf.enp8s0.forwarding=0
net.ipv4.conf.enp8s0.forwarding = 0
# docker run --rm alpine/curl -I --max-time 5 http://1.1.1.1 | head -n2
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:05 --:--:-- 0
curl: (28) Connection timed out after 5000 milliseconds"configuring Linux as a router" is exactly what "adding an iptables rule that routes" is. That's what it's for, that's how you do it.