I know the coinbase transaction's input is usually just has a dummy
scriptSig, but what if a miner used it to spend an UTXO? Would it be verified as an actual spend, or would the block be rejected?
It would be rejected. The coinbase input must use a very specific previous outpoint:
0x0000000000000000000000000000000000000000000000000000000000000000ffffffff. This prevents it from referring to an actual previous outpoint.