It does, because the attacker has no means to enumerate. Having the means to enumerate the address space always defeats ASLR (called an info leak). Without that

It does, because the attacker has no means to enumerate. Having the means to enumerate the address space always defeats ASLR (called an info leak). Without that, the attacker has to blindly specify what address they want to write to. Without ASLR, these are static across the same versions of a given app on different systems, so shooting blind isn't a problem. With ASLR, that option is removed.