This is a common critic of WireGuard, but it looks like those service are looking for excuses to explain why they don't propose WireGuard yet. As far as I understang it:

> What they probably need to do is to assign each customer a fixed private IP for use within their VPN, e.g. from 10.0.0.0/8.

Actually, they can set a different IP for each session and rotate them by given it to the client out of band, for example when it authenticates to the service.

> When those are not enough any more, they need to segment their VPN

Like with all other VPNs right? They could also distribute IPv6 for the tunnel and this would not be an issue.