Nah. That's just the lazy-ass traffic filtering policies of poorly-run end-user ISPs. [0] Every end-user ISP knows what IP address ranges it has assigned to each customer. It's fairly trivial to note when the source address of traffic coming from a customer's connection isn't in the range that has been assigned to that connection and drop it on the floor. This stops source address spoofing dead.

RFC 2827 (BCP 38) was published in May 2000. There's no good excuse for end-user ISPs to not be doing this for pretty much all of their customers.

[0] For the purposes of this discussion, I'm declaring that "cloud" providers are ISPs. They provide IP addresses and Internet connectivity to their customers, so they count.

Indeed. For what it's worth the spoofing aspect got better for a while then plateaued. [1] bcp84 / bcp38 adoption has pretty much stalled out. No idea what to do with the remaining ISP's.

[1] - https://spoofer.caida.org/summary.php