Temporary v6 addresses are not a security measure, they're a privacy measure. (And a weak one at that.)

An attacker can get route advertisements from your subnet if something is misconfigured on ISP side so they get out and do a tiny bit of inference to figure out which device it is.