It’s secured by design. Don’t accept Syncthing partner devices you are not 100% sure the device ID belongs to “you”.