Nobody allows zone transfers these days. But there is still the option for doing a dictionary attack on subdomains admin/ssh/console.example.com

But yeah scanning IPv6 address space directly without DNS dictionary in hand is tough.