I suspect more of the second than the first. If it's just inactive, a compromised host can often broadcast a router advertisement or perhaps use local net addresses to compromise other hosts. A well prepared network would block ipv6 traffic on their switches, it they don't want it, but that's a big investment in capable switches.
> You cannot completely disable IPv6 as IPv6 is used internally on the system for many TCPIP tasks. For example, you will still be able to run ping ::1 after configuring this setting.
I'd be concerned their workaround is just limiting it into a local vulnerability that spyware, etc will abuse on all the systems that end up not patched because they used the workaround..
..because it uses one of the available local escalation tricks, where sending RA to ::1 could be one of those if that is a thing.
That’s just flat out wrong. No pure IPv6 deployments exist on endpoints in practice. Only in internal networks. You either run pure v4, or dual stacked v4+v6.
IPv6 is gaining some pretty solid adoption these days, but it’s not there yet. Disabling it is holding back the deployment of it, and is a problem by itself.