Usually this should be coupled with two rules in the ipv6 firewall dropping input and forward, see point #33 here:
The rationale being that IF ipv6 is enabled (by mistake or by an upgrade or by "whaetever") you have a "second line" of defense dropping everything.