I haven't had a documented packet with IPOptions arrive on any of my firewalls, the packets are typically dropped, so exploiting remotely is going to be very difficult. In theory you could use another exploit and then lateral move in some networks which don't drop them at a router level.
Yeah, had this ever actually been proven in the "real world"?
Does it have to be? I am betting there's more people working on proving this and not disclose the proof than to do.
It doesn't have to be, but it's getting a bit weird that everytime this subject comes up nobody has an actual example.