There's a few more address blocks that should never appear on the public internet that do not appear to be checked for when processing the exit policy (Belong in private_nets) or in tor_addr_is_internal().
Traffic containing these addresses have no business being on the public internet, so the code should be updated to check for them and reject them where appropriate. Since tor_addr_is_internal() is used for things other than rejection, this probably should be done as a separate function that is checked when the code means "Reject things that should not be used" (most of the code) vs "Explicitly need a local address" (warn_nonlocal_client_ports() for example).