Worth noting that user agents are totally easy to spoof. If it’s Google, you can be pretty sure it will say so. But just because it says it’s Google, that means nothing.
(Same situation as robots.txt, these are mechanisms which assume trust. Untrustworthy parties can just play by different rules.)