If there is more than 1 IP in X-Forwarded-For we follow this piece:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-For#directives

A proxy IP address. If a request goes through multiple proxies, the IP addresses of each successive proxy are listed. This means that the rightmost IP address is the IP address of the most recent proxy and the leftmost IP address is the address of the originating client

And assume that the first one is the originating client (we only check that one) and the rest are proxy servers

It's true that a malicious client could use the same IP for the bad ASN and CC, that case would require more work to workaround, but the current setup allows us to manage innocuous cases like the geoip database shipped with the probe being outdated, which is more common