SQLNET.ALLOWED_LOGON_VERSION=12 and JDBC thin client
I just tested it too, and found that I can connect with 11.2.0.3/11.2.0.4 JDBC thin clients without error, but when using older thin clients like 10.2.0.4, then I get the expected ORA-28040: No matching authentication protocol.

In my opinion, the most logical explanation is that Oracle updated this document many times since 2011 and the particular line you quoted is in fact incorrect today.  It might have been correct pre-11.0.2.3.

Oracle doesn't maintain a change log (such as you would find on FOSS projects, a Wikipedia article, or even the StackExchange questions). However, you can get lucky sometimes if the page was crawled by the Internet Archive Wayback Machine. Turns out this Oracle doc was, so we're in luck, and they have snapshots of it dating back to 2011, preceding the CPUOct2012 by a year.
https://web.archive.org/web/20110715000000*/http://docs.oracle.com/cd/E11882_01/network.112/e10835/sqlnet.htm

Curiously, if you look at the Dec 2011 version of the doc above, the paragraph you cited actually said (back then):


  ... following implications of setting the value to 11 [not 12] ...


It would seem to me that someone at Oracle updated the number from 11 to 12 without researching the implications.

I vote for answer #1, the manual is wrong.

ADDENDUM: The above criticism aside, you probably want to either submit a "Reader Comment" on the bottom of the Oracle doc, or submit an SR, or both.  If you have an Oracle customer relationship, you're probably paying a lot of money, so might as well make use of it and file the SR. Either way Oracle responds your a$$ is covered. i would very much like to see Oracle's response to this question.