Since IPFS is based on content addressing, if a node tries to spoof a piece of content, any peers trying to fetch from the malicious node will immediately see that the content provided does not match the desired hash.

I'm not sure how peers handle that situation, I'd assume it'd be treated like wire corruption (retry) or give up and try to fetch from a different peer.

But that doesn't stop ddos attacks.

True, but a ddos also doesn't exactly mean the content is "exploitable".

I presume future clients would block nodes that share false content (if clients don't already).

Pins are something that's per-node, and whether a node has a specific piece of content pinned is not visible publicly (only that it's providing the content).