Not all networks perform NAT. The only time you have to perform NAT is when you have just that one router with its public IP address, and the rest of your network has private ones.
The quote isn't about egress filtering at the edge of those networks. Instead it's mostly about filtering on networks where all devices already have public addresses and there's no NAT – such as a datacenter full of servers, or an ISP's network with all the customers in it.
How would those spoofed packets from customers reach the ISP's network, though? Easily.
- A business customer might have its own pool of public addresses to assign to individual computers, servers, printers, or other devices.
- Even a home connection, with its typical single address, isn't actually bound to using a router: the customer could just as well attach a single PC directly to the modem, and that computer would immediately have an external address.
- Or as it has already happened on many occassions, a cheap router itself could be infected by malware and generating those spoofed packets on its own.
Finally, even when the network in question is one with NAT and private addresses, the question is whether its NAT rule is actually set up to match all source addresses... or just the private ones. It could very well be that some routers simply pass-through packets which already have a public source address, under the assumption that those have been "already NAT'ed".