Whether this specific level/type of deanonymization is a problem for your particular use case is an entirely different question. Personally, I wouldn't even care if mutual contacts were to see my IP address outright (and they do for calls), but I'm not every user.
But my PBX and my matrix server both use coturn. Our 10 user "private" PBX we have to VPN into a fortigate in a DC to use, but to my understanding, there's literally no way to eavesdrop on those calls without already compromising the server it's running on, and if that's the case, no extra VPN steps or whatever will help.
anyhow even with a real, publicly routable IP, stock windows 11, stock macos (used to be true), and most linuxes won't get compromised by stuff like backorifice or whatever else l0pht put out as "remote administration tools". that is, there usually isn't any listening ports on a public IP these days. Shield's Up!
That's probably correct (with the caveat that I suspect NSA/FSB/MSS/Mossad/whoever can reasonably be assumed to have backdoored Fortinet)
There is still the problem that an attacker with "global passive observer" capabilities (which almost certainly includes most non 3rd world nation states, and probably a few of the more problematic 3rd world ones too) can still do traffic analysis to uncover your social network (or criminal/terrorist/whistleblower/journalistic network) by identifying the call traffic endpoints.
Considering the almost weekly discovery of fortinet vulnerabilities that seems like a rather low bar
I suspect you're looking at that wrong.
It's each internet connection that gets a /64, not each machine. Your ISP hands you a /64 and you can do whatever you like with it on your home(/corporate) network.
So you can choose from 18 thousand trillion IPV6 addresses for any machine behind your ISP/internet connection, but the top half of your IPV6 address uniquely identifies that ISP and they can connect that to your account/payment details, with 4 billion times as much precision as an IPV4 address.
i get a /48, which i can delegate the prefix to 255 subnets of size /64, so each machine on my LAN gets a /64 this is Prefix Delegation, part of DHCP v6 aka DHCP-PD
edit: this is still "new" in that half the consumer routers only partially support it. but afaik it was in the spec for ipv6 that each node should be a /64, so realistically my LAN having each node with /64 is per spec, and machines that are NAT behind a single /64 at the gateway are out of spec and part of the reason that no one uses ipv6, IMO...
If i visit some site via v6 on my desktop today and in a month from my phone, at home via v6 over wifi, what percentage of companies will pool those two devices (assuming no pooling from merely being my device, etc). Either ipv6 is a nightmare or it's the utopia we were promised i will accept no compromises.