You trust the hashpower in the aggregate, you do not trust the node that gives you the information. That is because the block solution is independently verifiable by the spv wallet. They can also independently verify that a transaction was indeed in a block. To say they don't verify anything or trust someone is not true. They don't validate the rules, they validate the hashpower. If the hashpower is evil, bitcoin is fucked anyways. If the hashpower is evil your full node can be fooled into accepting a payment for something and reversing it with their superior hashpower. The whitepaper assumes the majority of hashpower is honest for bitcoin to work...

Whitepaper, section 1, end of last paragraph...

"The system is secure as long as honest nodes collectively control more CPU power than any cooperating group of attacker nodes."

If that sentence is broken, like you give as an example that would fool an spv wallet, then by definition bitcoin is not secure.