I've never seen an ircd cloak instruction page misrepresent what they can and cannot do. While protecting IP addresses is important (which the GDPR also believes in), I think it's also important to not lose perspective of the bigger dangers out there right now such as default user behaviour and conditioning. For example, IRC has never led to huge numbers of people publicly humiliating themselves by bitching about their employers, etc.
Like what outside of taking the scope outside of the IRC client (external link, etc)
An IRC cloak is programmed into the ircd itself ensuring that ones IP address is not exposed. I don’t think you can just hack that. If you use the external link trick, everyone is susceptible to that no matter what app/platform they use unless you use a VPN or Tor.
In any case there are some really obsessed people who probably know a hundred ways to take over your channels at the very least. Seeing some of these people do their thing is one of the reasons why I steer clear of IRC these days.
The Freenode decloak trick still works, though.
1) There are a number of ways to decloak somebody purely via irc/ircd fuckery - though it's liable to require several minutes of dedicated effort to do so.
2) There's a non-zero likelihood that if you try any of those ways we will spot you and k-line you.
3) That likelihood is not a guarantee, so when cloaking people we always make sure to warn them first that cloaks aren't 100% reliable and if users really want to protect their IP address they want a VPS, a VPN, or tor.
4) No, I'm not going to be any less vague about 1, just because it's not actually hard doesn't mean I want to encourage it.