I looked at How do I report a bug?, but the problem there is that they want to know specifically which package is at fault - something that I simply cannot answer. It seems to happen somewhere during the installation process, that's all I can say.
I got the installation file, copied it onto an SD card as per documentation, and started it on my first RPi 3B+. When the installation finished, I installed some updates and some programs that I need. I then cloned the SD card on a PC, and used the copy to start the second RPi 3B+.
Turns out: Both RPis have the same MAC address for their eth0 interfaces!
It looks like somewhere in the initial boot/setup procedure, the installation process digs up the processors serial number (on which the last three digits of the eth0 MAC are based), builds the eth0 MAC, and stores it somewhere.
The correct procedure would be to calculate the MAC based on the serial number at every boot, based on the CPUs serial number.
There is no such issue with the wlan0 interface, though, they do have distinct MAC addresses.
Where can I report such an issue to get it fixed in future revisions?