I see that indeed it is allowed to issue certificates for IP addresses (however not for private addresses). In my opinion this should not be allowed, there is no real justification for issuing them.

I don’t believe in too big to fail theories about certificates for local addresses, they are not allowed and should not be accepted. If your application breaks, you get to keep the pieces. I doubt there is a lot of real use though, apart from misuse as in the article.