This reminds me of when I used to do IT work for small businesses in college. One printing company I worked for, had about 100 computers on their network, and was using public ipv4 addresses, that they did not own, on their internal network. I forget what range they were using now. But imagine seeing a DHCP server handing out addresses like 142.250.110.1/16 on a LAN and the public ip being something totally different.
It was funny, because when I brought it up to them, it was hard to articulate why it was a problem and I couldn't convince them it was worth the effort of trying to fix. They never ran into a specific issue due to this while I was there but it felt so gross.
It's always hard because when you contrive possible examples of how it goes wrong, every single example sounds contrived because of course they are contrived.
Sure one day your printer might start spewing random json code meant for some microservice of the rightful IP owner.
Sure the IP's might be owned by the Air Force and one day they might start getting traffic from your pos ipad that they decide looks like an attempt to attack one of their internal secret networks...
Sure one day traffic meant to go to your printer ends up flooding and dossing a windmill controller, preventing the rightful operators from turning it the right direction during bad weather and causing $25M damage...
And of course the real failures are more like, only people from the Maldives can't send email to your email server, a failure with no impact.
The problem is that they wouldn't be able to talk to any internet service that legitimately used those addresses. Whether that was likely to be a problem very much depends on whose addresses they were.
There's a good reason to do this if you can't be certain what reserved subnets are used in a given network and you absolutely need a static ip for some reason.
At least that's the conclusion I've arrived at at some point, but I don't remember what was the exact use case anymore.
However there are still several global IPv4 ranges that are not local reserved ranges but are effectively reserved and you could use them if you really want to without any issues.
I used to do consulting for companies that weren't connected to the Internet yet. This was the early-mid-1990s and "Private IP Network" assignments literally did not exist until 1996.
Therefore, people who weren't on the Internet yet, or didn't expect to be connected to any particular WAN, or even had their own intranet WAN without public access, they improvised like crazy. Like, whatever IP address ranges worked for them, they just plugged 'em in.
Since it was indeed early, and IPv4 networks were being handed out like candy, the savvy companies just applied for their own network space, hopefully of an appropriate size. The applications at the time didn't specify or require that they route the traffic or put it into BGP, so registering your intranet with IANA was the right thing to do, and future-proof. Unfortunately, in the wild-west early days before CIDR, IANA needed to find either a chunk of class C, or class B without significant nuance. And that is how Apple, HP, and Ford came to control gigantic swaths of "Class A" space.
Renumbering private networks was one of the nightmare scenarios of consulting firms like mine. And it hasn't really stopped, I suppose. If your company does an M/A their private LANs may clash, and they either renumber or they NAT.
By the way, OpenWRT isn't supposed to be using ".lan". That's a ridiculous non-compliant behavior. Someone should've stopped that, long ago.
There are ways to subdomain properly and IETF has provided dedicated TLDs for it even now, but back in the day, it was not easy, and I get it. When I needed DNS for my homelab, I discovered that the best practice among bad practices was to subdomain your ISP's. Like, make up a fictitious subdomain and hang it off their real one. Then your DNS had an anchor in reality, even if it was all made up, never delegated, unreachable, unresolvable from the outside.
When I was working with Linux based kiosks and PoS systems I had a good share of issues with the Microsoft MVP signature use of .local on their forests. Back then their training material recommended .local for Active Directory services.
Specifically, either a registered name or a subdomain of a registered name reserved for this purpose, because the A records for the apex should or must — I don't remember which, but it's definitely the default configuration — point to the domain controllers, and you probably don't want to host your public web site on the same addresses as your DCs (or for that matter, your internal and public records necessarily hosted on the same server).
Historically (20+ years ago), some Microsoft documentation suggested .local as an example of an unregistered domain that could be used for this purpose, which was problematic when .local was subsequently reserved for multicast DNS.
Meanwhile, I watched a very prominent Microsoft consultancy shop install a client's ActiveDirectory as <nameoforganization>.ad. You know, the country of Andorra? That has an actual real ccTLD?
Given that there don't appear to be any BGP announcements for 25.anything, is it possible that the MoD uses this address range internally, or not at all, and has agreed to continue to do so?
It was funny, because when I brought it up to them, it was hard to articulate why it was a problem and I couldn't convince them it was worth the effort of trying to fix. They never ran into a specific issue due to this while I was there but it felt so gross.