What are the consequences if I spoof an IP address in the node_announcment message?
I don't see the attack here. You cannot claim you are a different node, because you cannot sign for that. All you can do is give a false IP address FOR YOUR OWN NODE. Which probably just leads to people not being able to reach you. 

I guess the only interesting case is where the IP you give is already known as another node. Maybe the spec should spell out what an implementation should do then. But I guess not doing anything is probably fine, since you could still reach the known node under its IP adress (node lookup being per ID, I guess), and whenever you try to reach the spoofing node under the fake address, it just won't respond.