Passing incomplete information to an SPV node
This is a a known shortcoming. The SPV protocol does not protect against omission attacks.

An SPV wallet can request a proof that a given tx is present in a given block, and that a given block is part of a given chain. However, it is not possible to prove that the node isn't omitting a transaction the wallet would like to know about without providing the entire block data for each block, at which point you are essentially a full node.

Wallets avoid this by connecting to multiple nodes - as long as there is one honest node in that connection pool, the wallet will receive up to date information.