Good point. However, collectd's protocol is much more complex that carbon's; it can sign or encrypt the data to prevent spoofing. If spoofing is a concern, then instead of having collectd on your systems being monitored send directly to carbon, have them send to a collectd instance on your graphite server, and have that instance send to carbon on localhost.

https://collectd.org/wiki/index.php/Networking_introduction