1. That for this to be a DOS type exploit, the attacker needs to exploit a race condition over network, which is an incredibly unlikely event that one can't really force.
2. For it to be a root exploit they need to craft the IP options with a specific memory address, but that memory address isn't known to the attacker because it's not a constant (see KASLR).
3. There is also a simple fix by simply adjusting iptables, and much/most/many network setups already drop IP options by default.
If I'm misunderstanding something let me know, but in practice this doesn't seem like it's likely to cause much damage. The people at Canonical and Redhat probably came to same conclusions and are balancing the true risk (not CVE risk level which are not very useful) with the potential for introducing a regression for their customers. This kind of stuff happens somewhat often and never catches fire like this, I think Anthropic is just fanning the flames and Ubuntu is taking the heat.