Right, a corporate spammer can tell google that an email is a calendar event (valuable data!). But the receiving user can't do it themselves using some other calendar app.
In android's intents model it's the email app so that would need to use the create event intent to send the data to the calendar.
To do this the calendar would need to access the emails - which would need either IMAP built in to the calendar app [EDIT: or to change the android permission model].
The point of this structured data format is that you don't need to give the calendar app fill access to the email; just to the attached calendar info included in the email, which can be attached to the intent.
