[laggyluke]

Why not both?

Sure, it'll lead to arms race like you describe on one side, but let's say 99% of the apps won't even engage in that arms race if the fake data is generic enough to cause a high number of false positives (blocking someone who's not actually faking the data).

Then, we can focus on the remaining 1% of worst offenders to actually enforce the policy.