Internet standards are not created by a single organization or person (well, not anymore). Everybody can help design the standards.

I'm greatly simplifying, but roughly it goes like this:

1. Someone proposes a change.

2. If there is enough interest in the proposed change, an RFC (Request for Comments) is created, in draft stage.

3. Stakeholders can comment, if agreed upon the changes are placed in the RFC. Rinse and repeat.

4. Once enough stakeholders are happy, the RFC is accepted and it becomes an internet standard.

An RFC in step 3 may already be mature enough to be used in production, though just not yet finalized (step 4).

Before 2017, IPv6 was already being deployed because the RFC was already quite mature. However, with IP being such an important protocol for the internet, it took a long time before the RFC was finalized, though not much was being changed. In 2017, the RFC was finalized and thus it was set in stone (until a new RFC is created) that that is how the protocol must work.

[0] https://en.wikipedia.org/wiki/Request_for_Comments

RFC 2460 dates back to 1998 [0]. There was an updated standard published as RFC 8200 [1] in 2017, but it is not uncommon that standards get updated by a new revision - the current standard is just as 'finalized' as the 1998 version was.

[0] https://datatracker.ietf.org/doc/html/rfc2460 [1] https://datatracker.ietf.org/doc/html/rfc8200

Hmm, but weren't there a lot of changes between 1998 and 2017 in terms of how IPv6 security should work ? (often changing random suffixes and such ?)