That's not entirely correct: the baseline requirements only restrict certificates for private IP addresses (called Reserved IP Address there). For public IP addresses, it is perfectly possible to get a certificate for, just not from Let's Encrypt (I don't know why).