If it doesn't protect against ARP table overflow then that is again a missing feature in that software. Just like it's not IPv4's fault if there are no protections against someone sending a thousand DHCP requests and depleting the pool or filling some tables.