Except, most folks use UDP, and IP auth is simply broken on many SIP platforms. If you can spoof an IP packet (who can't?) and you know someone's IP that's allowed to send traffic, _most likely_ you can auth as them and complete the call and no one will notice. More paranoid implementations will give each customer their own IP and setup firewall rules, which mitigates the issue.
Either way, using UDP and going off IP is still terrible. Because now, a spoofed IP packet comes in, and based on that packet alone, you're going to start up all the call processing and make a call. The SIP transaction might timeout and end the call in 5-60 seconds, but it's very open to [D]DoS'ing. Oh, and even some major platforms consider 100 calls/sec to be "high volume", so even an unsophisticated attacker could probably bring a lot of systems to their knees via IP spoofing.
The real mitigation is that there's so much low hanging fruit, that hackers are just going after the quick buck by hitting PBXes or phones and calling rebate numbers or 30+ cent destinations.
Telephony has traditionally been a trusted system, and a lot of that's carried over to VoIP.
Your third sentence contradicts itself, so it makes you seem either uninformed or deceptive.
If these difficulties should be blamed on non-native English use, please say so.
Inbound Phone Number existing Carrier
Lets assume, you have existing numbers you own with your existing carrier. Carriers usually allow forwarding to certain IP destination or hostnames like sbc.plivo.com, so what you will need to do on your carrier side is to just configure this one time for the numbers with them.
On the Plivo side, for us to be able to enable the carrier to pass through our firewall, you would whitelist the Carrier IPs using our APIs/UI and then add (not buy) the numbers in the system you own with the carrier. That we it allows us to be able to match the incoming calls from a certain carrier on a certain number to a customer app. (there are tons of edge cases here I am not covering, but we have taken care of that in the implementation)
Outbound Calls via your Carrier to phones
This is a bit more tricky and complex as users may want to use Carrier 1 for Country A, Carrier 2 for Country B etc.. so we allow customers to be able to configure this logic using our APIs and assign them with dedicated IPs which allows the carrier to distinguish where the call is coming from for them to bill/ account it.
It may sound simple here, but trust me, when you open up that kind of logic to every customer, it becomes a tough problem quickly and thats where architecture matters. I am not sure, I want to talk about how we architected the system, so will leave it for later discussion.
Regarding DoS or DDoS, IP spoofing is not so trivial, as first one needs to figure out carrier ip, then customers phone number and then all they can do is just trigger the app which can perform some business logic. So again not sure if there is any security risk with this.
I'm pretty OK with the sort of spoofing you describe, since ISTM it will impact Plivo rather than the Plivo customer.