Without assuming MITM, existing transport and/or upper layer
protocols using cookie or cookie like information can be naturally
extended as a reasonable protection against connection hijacking by
false source information.
That's not quite true. Obviously when there is a man in the middle all
bets are off. However, when protection consists of cookies then a "man"
doesn't have to be "in the middle": being on the sidelines is good
enough. For instance, the attacker may be on a shared subnet (such as a
wireless lan) with one of the victims, allowing him to intercept the
cookie and subsequently inject false packets into the communication
between the victims. Under some circumstances, this may be enough to
steal a session.