Let's assume i have created a game, and then created ERC tokens (Example swords) so the player must buy a token to be able to play the game.
What if someone creates similar tokens in his wallet and injects them into my game as if they are bought from my tokens store

To see the fake token is very simple, I found that just if you look closely, you will see that the contract address is different from the real project. Any fake token can be imitated in name, website... but can never fake contract address, which we all can easily recognize. And if you're programming your game properly, that won't be possible. That depends entirely on how well you connect your game to the smart contract? What about experience and knowledge?.