Senders to Apple's email proxy needs to be pre-registered first (and I highly suspect the generated addresses are scoped to each individual app's whitelist), so no, not everyone can send to those addresses.

The sender already is pre-registered. We're talking about users who have successfully Signed In With Apple ID.

After signing up you would request a non proxy email. Hence, the “real” email. You would then test that the user supplied email is legit.

But nothing is stopping the user from supplying a proxy email address in your textbox where you ask for a non-proxy email address. Sending a test email doesn't tell you whether the user-supplied email address is a proxy email address or a non-proxy email address, since your test email will go through in either case. That's the whole point of a proxy email address instead of a completely fake email address, is that emails sent to the proxy email address will still go through.