Apparently it's never worked since its introduction.

.addr is non-nil exactly when .dst_addr is non-nil
(which hapens iff the query originated externally).
Now we have semantics which was probably intended by the original code
(98216295 from 2016) but that semantics is still problematic
if you need both kinds of matching in a single request from client.

This matching by destination has never made it to docs,
so let's just add this simple fixup for now, and later
we'll steer users to new policy configuration anyway.