Hahaha

Yes spoofing is a concern. That's why the login mode requires a PIN (that it actually can be a alphanumeric password). The nsec is encrypted with the PIN and the phone number is hashed, so at the DB level there aren't any confidential data.