How is this enforceable?

That's the joke of RFC 3514. Setting the evil bit of a packet to 0 means it is harmless and no defensive action should be taken. Secure systems should defend against packets with the evil bit set to 1. Insecure systems may choose to crash, be penetrated, etc.