They're trying to sell you something that should be worthless.
HTTP protocol allows for this kind of stuff. I could set the User-Agent (AKA, "What kind of browser are you using?") to
"User Agent: User Agent: User Agent: Trust no one"
If your software isn't taking into consideration code injection (SQL, Script, etc...) in a modern way, then this could have been an issue. But you wrote your software using best-practices and have correctly sanitized all inputs and are using a database abstraction layer, right?
In terms of ways to improve your security, monitoring things such as origin, request frequency, profile the requests they make, check user agent, check referrer page, checking ... everything, is an active monitoring you can do to provide more security. I don't believe this is what they were trying to tell you to do (as per part of Alex's answer), just that "You can change this," which is a total "no-duh" to anyone who knows HTTP well enough, but probably just a way to scare up some value-added fluff.
So, if your PHP code allows for any input -including- a user-agent string to be inserted to a DB without being properly sanitized, and use of a database abstraction layer, you're going to have a really bad day.
I'll give you a free tip, your referrer header can be set to this:
Referrer: \' -- TRUNCATE `Users`
The problem isn't that you can set these headers, you can just as easily submit that data as "Name" in an address form.
So here's the question, do you want to let people who's user-agent you don't have in a table somewhere not use your website? Probably a stupid idea because a
hacker can just set it to a valid one anyway.