A small risk, and something that could be mitigated, but still there nonetheless.
The proposals to encrypt ADS-B data, being driven by corporations and wealthy individuals, are more risky in that they add key management to the mix and make it much more likely that something will go wrong and cause widespread ATC failures or aircraft going dark on ATC displays and in collision avoidance systems at critical moments. Especially as there'll be a mix of encrypted/non-encrypted transponders for decades to come.
There is also an argument for some sort of cryptographic signing of ADS-B messages in order to prevent spoofing.
Is all of this really necessary when billionaires have other means at their disposal to avoid scrutiny? Why add risk and complexity to a critical system just to make their lives easier?
Spoofing is not really a useful attack vector, for various reasons. In any case it's also not something that can easily be retrofitted for the same reasons, in that it takes decades to update these systems.
Only through a manual process that sounds like it can take a month or so to complete.
Perhaps, in future, this could be solved with technology that automates generation/randomisation of PIAs, much like MAC addresses on phones and laptops are randomised to prevent tracking?
Next-generation ADS-B transponders could communicate with the FAA (or appropriate local authority) via satellite or mobile network to generate/request a new, random PIA before every flight.