I'm probably speaking _way_ out of my league here, but I imagine it's somehow spoofable, kinda like how you can generate fake MACs or IPs, so why not? One terrifying/beautiful element of tech is that where there's a will there's a way!

It's spoofable in the same way that a hash collision or guessing a password is "spoofable", given infinite time and / or energy you could. But the chain would move on while you're generating your spoof, and you're limited by the constraints of the physical world and your available computing power.

Not exactly... You just need the majority to agree that the new manipulated chain is the real chain. You don't need to find a SHA256 collision.

A smaller currency would be at risk but the upside would also be smaller. Generally speaking there doesn't seem to be an incentive large enough to justify the enormous costs associated with a 51% attack.