The last 6-ish characters are a checksum. It would be very computationally intensive to generate a similar-looking address without changing the checksum, though of course not impossible.

Public addresses are 160 bits in bitcoin, so it depends on your character encoding. But yes, very long and random.

Pieter Wuille has a very interesting talk on public addresses and some novel work he did to drastically improve address error detection. Worth a watch for some cool computer science. https://www.youtube.com/watch?v=NqiN9VFE4CU

Honestly, it's kind of surprising that these kinds of exploits don't happen all the time since base layer bitcoin transactions alone secure $14 trillion in annual transfer volume in recent years. That's a huge honey pot for malicious attackers that seems to mostly go under exploited.

Perhaps a better way would be to use something along the lines of SSH’s randomart.

I’m sure there would be an even more interesting variant where the address could be used to generate a prompt for DALL-E.