RFC 1918 (Address Allocation for Private Internets) implies that addresses belonging to the private address space
should not (can not? / must not?) be routed to the public internet.
Question: does Routeros block this automatically or is a firewall filter rule required?
Regards
Gerd
The answer is: NO.
You have manually set all needed rules. The dafault configuration has them prepared initially but you have to accept this configuration which expects that you put proper cables to WAN and LAN ports. Default WAN port is usually ETH1 in the ROS world.
There could be no directly expressed rule stopping leaking private packets to public side as eg. masquarading for WAN port indirectly sets/ensures such filter.
However if you incidentally put ISP cable to any of LAN ports then nothing stops private packets to be mixed in public traffic and public trafffic to be seen by your local devices.