In practice webp isn't usually spoofed, and when it is it's by people who've thought through the consequences and are in a position to deal with potential breakages.

Client side feature detection can also be spoofed, but in practice that's bit a problem either.