Email is a great example. We've patched things on top of it to try and fix the fundamental flaws but they're still there. An easy one is that you don't have to prove you own an email address to send an email that looks like it's from that sender. We added DKIM, DMARC, etc. But the flaw still fundamentally exists.
As an aside, although I haven't seen any explicit language discussing this, I'd say that an IPv6 (even a random one thanks to privacy extensions) is exactly equal to an IPv4 address. My house has a static IPv6 prefix, so if you see an IP from that subnet, it's someone in my house, exactly as if our shared IPv4 address showed up in the logs. In my opinion, the host portion of the address is basically equivalent to a random port number for identification purposes.