Isn't that a widely held, but incorrect, assumption?
eg People with reasonable knowledge of IPv4 on *nix can still route 127.0.0.1 traffic out through an external interface?
From memory, people used to do that when attempting to bypass various firewall/filter rules on other hosts for a locally attached network.
Maybe things have tightened up/changed in the last few years?
The earliest documentation I was able to find is in RFC 1122 [1] from 1989, but according to RFC 6890 [2], the principle dates back to 1981.
[1] https://tools.ietf.org/html/rfc1122#section-3.2.1.3
[2] https://tools.ietf.org/html/rfc6890 (table 4)
Once the OS is up and running, manipulation of the routing tables at least _used_ to make this possible on Linux and Solaris. Not sure about FreeBSD, but that's just from memory fuzziness on my part. :)
This is definitely false, without any routing tables. Any unprivileged user can start an SSH tunnel listening on any localhost port above 1024, sending traffic out to wherever.