Not so. A PKI could have been put in place and would have allowed "strangers" to securely authenticate and set up a secure session, but I suppose the expense was not deemed worthwhile. Also possible is that such a session would be point-to-point, and an area handshake, while possible, would have been less reliable and more complex, while also loading the bandwidth with more radio traffic and thus increasing the noise floor overall. ATC running costs would have increased as well.

So it's not that it couldn't be done or is inherently insecure, it's that a choice was made (either by omission or by intent) to not do it.