Caller ID spoofing is a feature, not a bug. It’s there so corporate phone systems can have an external number showing that is a main switchboard or other central number, but the call can be coming from anyone’s desk within the company.
Way too much of corporate communication depends on this feature to remove it, I think. So the carriers are left trying to distinguish fake spoofers from legit ones.