It looks to me like the default Exim config in Debian explicitly calls /usr/bin/spfquery.mail-spf-perl from the spf-tools-perl package, not the libspf2 implementation supplied by the spfquery package. Also spf-tools-perl is suggested by exim4-base, while neither spfquery nor any other packages built from libspf2 seem to be referenced by any of the exim4 packages.
I seems the only way Exim users on Debian are likely to be impacted is if they've edited their configuration to call the alternative spfquery implementation instead of the suggested one, and explicitly installed that package.
