MikroTik: NAT Masquerade kann ungewollt private IP weitergeben aber warum?

Masquerade

... it was designed for specific use in situations when public IP can randomly change,...
Unfortunately, this can lead to some issues with unstable links when the connection gets routed over different links after the primary link goes down. In such a scenario following things can happen:

• on disconnect, all related connection tracking entries are purged;

*next packet from every purged (previously masqueraded) connection will come into firewall as new, and, if a primary interface is not back, a packet will be routed out via alternative route (if you have any) thus creating a new masqueraded connection;

• the primary link comes back, routing is restored over the primary link, so packets that belong to existing connections are sent over the primary interface without being masqueraded, that way leaking local IPs to a public network.

To work around this situation blackhole route can be created as an alternative to the route that might disappear on disconnect.
...
overcome limitations RouterOS includes a number of so-called NAT helpers, that enable NAT traversal for various protocols. When action=srcnat is used instead, connection tracking entries remain and connections can simply resume.

On disconnect, all related connection tracking entries are purged
Next packet from every purged connection will come into firewall as connection-state=new, and, packet will be routed out via alternative route thus creating new connection entry
When primary link comes back, routing is restored over primary link, so packets that belong to existing connections are sent over primary interface without being masqueraded