The op meant someone can make their own component that’s fake. Not that they’d send fake data to your service.

And there’s no way to distinguish a component that uses your real social proof from someone else’s fake social proof.