Suppose an SPV client goes offline at block X (meaning it has block headers until block X) and then comes back online when the blockchain is at block Y. At that point, it needs to resynchronise its UTXO set. So, it does the following: (1) get the block headers of blocks X to Y; (2) construct a bloom filter for its addresses and request a full node to send all the transactions matching this bloom filter from block X to Y; (3) the full node does so and if a match is found, sends the transaction data along with a merkle proof to the SPV client; (4) SPV client verifies the proof and if it's correct updates its UTXO set accordingly.
Is this the way things actually happen?
If yes, then my question is then why can't the full node simply do the following: (1) send its UTXO set to the SPV client; (2) SPV client then filters the UTXOs of its interest and put those UTXOs in its own UTXO set.
Is this method not followed because it doesn't involve any verification from SPV client and this the full node can give the SPV client a totally wrong UTXO set?