SPF Validation is skipped for safelist members

Not sure if others knew this, but it came as a big surprise to me.   When you add an address to the safe list, it's essentially telling the Fortimail to bypass SPF checking.  Yes,  in retrospect I should have realized this because SPF is one of the antispam checks which are ignored for safe lists. 

But this seems like a terrible idea to me because we're telling the system to skip over all antispam protection based upon the sender... and we're not checking to see if the person sending is who they say they are.   Essentially, we're doing Authorization without Authentication.  It seems like SPF checks should be MORE important for people in the safe list, not less.

This seems like a really big deal to me... because knowing that a company is going to mark it's most common business partners as trusted, you can then confidently spoof mail from that domain without having to worry about SPF checks.  I can see that we'd need a way to override the SPF check for certain business  partners that just can't get the SPF thing right, but these would be the exception.

I know that we can do a SPF check at the Session level, but when it fails there it only increases the reputation score, we don't have the option to set a specific action here, so we can't count on this being effective.

It really seems like there should be a setting for an action to apply under SPF in the session profile, or the SPF check should be moved (or added) to the content section so that having a domain on the safe list doesn't remove the ability to enforce an SPF check for that domain.