Good for them. Because security infrastructure has lagged far behind, on by default v6 encapsulation schemes like 6to4, teredo, and isatap amount to huge attack

Good for them. Because security infrastructure has lagged far behind, on by default v6 encapsulation schemes like 6to4, teredo, and isatap amount to huge attack surfaces. When 99% of the world relies on v4 based network edge packet filtering these protocols essentially amount to automatic firewall evasion. Sure the ports can be blocked or DPI can be used by administrators, or users can turn off these services but the reality is a vast majority are unaware and vulnerable. While they (generally) aren't an initial attack vector, they are easily and often used by attackers that have knowledge of MAC addresses ahead of time, to hide traffic in plain site after an intrusion, or to hijack traffic in one hop away scenarios. Look at any non-automated intrusions coming out of asia and you'll see 6 encapsulation in use two out of three times at least. Unless the user has turned on these tools intentionally, or is operating in a legitimate native v6 environment, OS's should never pick 6 first if both endpoints can complete the route with 4.