Google also sends google-bot without the header. If it notices different content it will take the public version as truth.

So many people are doing this but not getting delisted. Not sure how solid a rule it still is.