2. The IDFA is just a simple static UUID. It cannot do a very good job at preventing fraud. There is no way to validate anything about it or affirm that it ties to a genuine device.
2: On a single request, yes. But users typically make very large numbers of requests over time. The pattern of requests that you'd see from a real user looks pretty different than what you'd see from a bot.
Of course they look different over time, isn't the problem here that same data can be used to do statistical analysis for other purposes than fraud prevention?
But yes, of course IDFA can be used for things other than ad fraud detection.