I suppose not. It breaks location transparency and IP spoofing is trivial.
My guess would be that a well written game would first demand authentication through a secure channel and return an encrypted authentication cookie. The client would be asked to provide the authentication cookie with every udp request (with mechanisms in place to counter replay attacks and the like).
In my experience, games typically use TCP for most communication and save UDP for realtime things like movement. TCP and UDP are generally used at the same time on the same port.