Maybe it means a non-reserved IP? 127.0.0.1, is often used as localhost for example, but all of 127.0.0.0–127.255.255.255 is reserved. There are several reserved blocks like this. If you include reserved addresses, every 32 bit pattern is a valid ipv4 address at least in theory. I hear network equipment in the real world is entirely another beast. I remember some ISPs did not work cloudflare's 1.1.1.1 DNS presumably because they were using the address for something else.
IPv4 has a lot of reserved and special-purpose ranges. Hell, I don't think most people could even recite the three major private-use blocks. Multicast and link-local addresses have more complications.
IPv6 is similar, though a little better consolidated. While there is one range of addresses reserved specifically for organization subnets at your disposal (fc00::/7), a lot of people assume just about anything not currently assigned for the internet (presently 2000::/3) will be safe forever.
I understand your point, but I think the context is more of "They can't even handle a fizzbuzz level problem" and not come up with something quite naive (i.e. something like naive RegEx matching), rather than "they can't implement a professional IPv4 validator that takes into account all the intricate special cases with subnets and reserved address blocks."
