This attack requires that r'=ru mod p-1 and r'=r mod p. If r' were less than p-1, it would have to be that r'=r=ru over the integers (no modulus), which is unlikely as u is computed from two hashed values (and thus, u is likely not 1). Thus, for this attack to work, r' must be larger than p-1.

This attack requires that $r' = ru \bmod p-1$ and $r' = r \bmod p$. If $r'$ were less than $p-1$, it would have to be that $r'=r=ru$ over the integers (no modulus), which is unlikely as $u$ is computed from two hashed values (and thus, $u$ is likely not $1$). Thus, for this attack to work, $r'$ must be larger than $p-1$.