Spoofing is extremely common. It has made Caller ID 100% useless. Apple can do nothing about it. Nor can any other company.
We get at least a half dozen calls a day from scammers spoofing local numbers, but ring as long distance (we have Distinctive Ring on our business land line). That tells us before we even pick up the phone it's a garbage call.
In a case of how easy spoofing is to do, a reporter who was researching for an article was fielding as many scam calls as possible and pretending to go along to see which were done better than others, and how. One was from a scammer claiming to be from Social Security. The reporter said he wanted proof and the scammer said to give him the number for a local SS office and he'd have someone there give him a call.
Less than a minute after providing that number, he got a call (according to the Caller ID), from that number. But the reporter already knew it was fake. He knew there's software that allows you to place calls from your computer using any number you type in as the Caller ID info, whether it's a number that exists or not. And that's exactly what the scammer did. The person calling back? Just another scammer in the same location.