I don't know if that's right. It seems to me that this could be a critical part of a larger attack: One attack that occurs to me is to pause a client when it i

I don't know if that's right. It seems to me that this could be a critical part of a larger attack: One attack that occurs to me is to pause a client when it is looking up a DNS name, but before it has gotten the response. With the plaintext DNS response you can get the ID field and forge a response. If you can do this during an HTTP request you might be able to redirect your victim to another server. TLS might be much of a problem either: a lot of devices poll HTTP urls to detect "captive portals" -- many offices even use these for corporate login via wifi, so our attacker may attempt to go after this infrastructure to collect corporate credentials. There's probably more: Applications have been assuming this wasn't possible for a long time, so there are likely a lot of vulnerable targets.