I had the same first impression, and it's not like ICMP unreachables weren't already a security issue (they're how you do UDP port scans in the first place). I assume there's a reason they're kept enabled. But you could keep them enabled and approximately 100% functional while breaking this attack just by dropping a couple now and then.