I noticed this 6/16. I have a cloudflared tunnel configured for a network subnet (/16). I have 4 policies using email addresses and which specific IP ranges they can access. I have a block all policy tanked last (5th in my case) that has the full ip subnet (/16) with no identities and block as recommended in the docs.
As of today, this is blocking even if the policy with my email address matches and is listed first. I have had to disable this block all/last policy to get the higher priority (1-4 entries) policies to work.