There's no guarantee, a block producer could publish a false declaration, but this is the kind of behavior that will likely get them voted out as a block producer.
They can also optionally publish GPS coordinates, which is particularly useful for block producers on mobile platforms that are moving between multiple jurisdictions.
This looks like a potentially major design flaw.
Not really, it's no different from any similar situation in the real world. When you lease a server in the cloud, you "trust" that the server company is telling you the truth about where the server is located. And if they lie about it and you suffer harm as a result, there are legal remedies available.