Not so. A PKI could have been put in place and would have allowed "strangers" to securely authenticate and set up a secure session, but I suppose the expense was not deemed worthwhile. Also possible is that such a session would be point-to-point, and an area handshake, while possible, would have been less reliable and more complex, while also loading the bandwidth with more radio traffic and thus increasing the noise floor overall. ATC running costs would have increased as well.

So it's not that it couldn't be done or is inherently insecure, it's that a choice was made (either by omission or by intent) to not do it.

It's a one way protocol. Pure broadcast. No session.

Note that anyone with a hundred bucks can buy a used aviation voice radio and do all the spoofing they want. It just isn't a problem because people don't like jail. The problem of getting acceptable reliability in an aviation electronics environment is tough enough that deliberate attacks fall below the noise.

Yes, at least put a signature block in the protocol.

I guess it's similar to the AIS signals used by ships.