Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-08.html