Something else: The Doctor was described as an international arms dealer. A business like that requires huge amounts of capital (okay, Spike had the contents of the Gem of Amara treasure vault, but bear with me here), a fairly extensive team of people working for you, just to handle the logistics of procurement, transportation, storage, inspection and repair, if necessary (can't afford to sell your clients defective weaponry. They tend to come back mad carrying working weapons), and, finally, delivery. But most of all, you need the proper contacts. Even if Spike did do a little small time procurement and delivery, it would be the equivalent of someone selling stolen handguns out of the trunk of their car. Imagine that small time dealer accidentally coming into possession of some sort of thermonuclear device. He's got the goods, but no buyer, and no way to get in contact with a buyer of something like that.
Spike might, and I emphasize MIGHT, serve as a go between/delivery boy in such a deal, which would fit in with his "holding them for a friend" story, but he could not possibly be the Doctor.
Most likely, Spike was just keeping "something," he didn't know what, for "someone," he didn't know who, for a fee, which probably wasn't very much in proportion to what he really had, or he might have gotten suspicious.
Much more likely, the Suvolte demon was government property being used in a sting operation, which is the real reason why Riley didn't want it killed, in order to draw the Doctor out and kill/capture him. Spike was probably just the unwitting delivery boy, and Riley was just exploiting the situation in order to get one more dig at Spike.