My first thought was "is this legal?", but then had a hard time considering even which jurisdiction this (or using a "fraudulent" IP location) would fall under?
This is exactly why, unlike much of the industry, we maintain a large team across engineering, data engineering, data science, and research, along with a substantial data-processing infrastructure and 1,200+ servers. Our entire purpose is to verify location data rather than simply aggregate, parse, and repeat whatever is self-reported. Otherwise, it’s just GIGO.
Even though we came up short in this particular case, we are actively pushing updates right now that eliminate these issues going forward.