The security section fails to explain how the service prevents an attacker from intercepting a packet, then sending it again himself with a new sender IP address to whitelist SSH access his IP address.
The original (authorized) sender would then think something went wrong (packet loss), send a new packet and be none the wiser.
The original (authorized) sender would then think something went wrong (packet loss), send a new packet and be none the wiser.