This is quite an over simplification but a large amount of the filtering, if placed close to the client, is a single line of config.
"ip verify unicast source reachable-via rx" in the Cisco world.
This should be the default.
I don't follow. Seems to me that whatever program/firmware on the router knows where to send incoming packets must also be able to trivially check and filter the addresses of outgoing ones.