The "proof" part of proof of coverage is very weak in Helium currently. Clearly most people are in good faith, but it is inherently vulnerable to Sybil attacks, because there's a chicken and egg problem with starting a new group of hotspots in an area with no external 'trusted' hotspots to validate them.