All geostationary satellites need to be capable of at least some station-keeping to correct for drift, move them to other service areas, or move them to a graveyard orbit at their end of life. (Unlike LEO, GEO satellites don't carry enough fuel for de-orbiting, and friction is essentially nonexistent at that altitude.)

That layer of commands is hopefully very well protected.

Typically some form of HMAC authentication. You can read about it in the CCSDS Blue Book.