It's the player software making the request directly to the server hosting the xml file, no? Who would be doing the proxying?

The whole point is that other players are free to completely ignore the tag.

I suppose if the podcast creator didn't want other players to be able to access the feed, they could set up some flavor of authentication. Requests from the preferred player app would include a key, and all other requests would get a 403. I don't really see what advantage that approach would have over a completely closed platform, though.