Now we're getting circular :) Sure, some humans send fake UAs. Although I suspect 99% of those humans are WebmasterWorld readers. But they wouldn't pretend to be an outdated cell phone; that's a way to get blocked. Humans trying to be discreet will either send something hopelessly generic like the current Chrome, or a string of complete gibberish that says "I'm wearing a mask and I don't care who knows it because you still can't see who I really am".
In this case, IP and UA do seem to fit together.