> It does seem surprising the To: header isn’t one of the headers that is covered by the dkim signature

It is, which is why they had to preserve it. The screenshot of delivery under the reproduction section shows the original To: address. This isn't the address that it is delivered to; you can deliver an email to any address with any other To: field in it.