Another example which User-Agent strings are also used, is in SIP. While your Blacklists/whitelists are often defined based on User-Agent strings.
For example the security scanning tool sipvicious uses the User-Agent (friendly-scanner). This User-Agent can be blacklisted so requests containing "friendly-scanner" are rejected, or better yet receive no response.
It is also a method to whitelist, an example would be in a IP-PBX scenario you can define the User-Agent of the SIP Phones/endpoints you are using and only allow their registration requests to be processed.
In this cases someone spoofing the User-Agent could use scanning/attack tools to circumvent the first layer of security to hopefully retrieve more information about the system(s) that reside in the SIP network or execute an exploit.