I think its known Google can masquerade as a "normal" visitor if it suspects you of cloaking (non identifying UA string and coming from a non disclosed google crawl IP)

https://support.google.com/webmasters/answer/66355?hl=en

I think they also use this to notify you in webmastertools when/if your site is hacked and is doing it to avoid detection by the normal user.

Or detect the user agent and simply serve different content? I'm pretty sure that Google penalties this though.

Yep. Here you go: https://support.google.com/webmasters/answer/66355

Here's the full "Don't do this sh!t" article from Google: https://support.google.com/webmasters/answer/35769#quality_g...