> 2. It is infrequent that RFC1918 space is used internally in telecom networks. It does happen, but it is rare.

I have worked at 2 different ISPs... RFC1918 is used EVERYWHERE, including on networks that customers can reach by sending packets through their modems/CPE. I am also familiar with the internal network of 3 others because we closely worked together during a bunch of merger/acquisitions/divestments/territory split-ups.

This caused a lot of fun when one customer ran nmap across all of RFC1918 space and hit internal security systems that were advertised across the ISPs backbone but were not properly filtered for traffic coming from customers because of a bug in a CMTS that failed to properly apply ACL's.