First of all: Bitcoin Core by default does not support BIP37 anymore, because it can be used as a computational, disk I/O, and bandwidth attack (because of points you bring up), and it has very weak privacy properties to begin with. It can still be enabled using -peerbloomfilters, but more modern approaches shouldn't depend on it.
Find a block in which ...
When validating a block, the verifier has to know all the transactions in full.
So they can just recompute the Merkle root from the transaction hashes, and compare it with the one stored in the block header.