express_egg

Piggybacking:

It's really difficult to get ION papers, but they do generally put preprints on their lab page: https://radionavlab.ae.utexas.edu/

+1

A USRP N2X0 will spoof a phone in the same room just through leakage

You're generally not wrong, but the things you mentioned make assumptions about having a data connection (not typically the case for receivers of interest - power grid, military trying to operate without RF signature, etc), and there is also an engineering aspect to it: with a big power/data/computational/financial budget most problems can already be solved. Solutions that are practical for you phone or a budget receiver are lacking. Losely organized to your points:

It depends on how the attack is carried out - there are data attacks and timing attacks (the article is generally terrible and has no info). In a data attack the navigation message is altered. Like you suggest this is easy to validate. Note though that most phones (and all new Android phones afaik - don't know about Apple) use assisted GPS, so they download navigation data anyways and a data attack would generally be ineffective. Timing attacks use authentic nav messages, but simulate signal arrival in an altered order, or replay previously recorded signals.

Whole constellation spoofing is not difficult anymore, especially for state actors whole can carry out full-sky attacks. You have no real way beyond correlation/signal strength (which can be attenuated by an attacker) to tell how far away a signal source is, and if you only have a single (stationary) antenna you cannot tell the geometry either (i.e. if signals are coming from multiple sources as expected, or a single antenna).

Multipath is a huge problem, especially in receivers which have linearly polarized antennas like smartphones. Usually when a receiver tracks GPS signals it looks for the signal arriving first (because later signals would be multipath reflections). It is an expensive operation to track multiple occurences of signals, high end receivers do though.

Ionospheric delay can fluctuate, so I don't think this would be very reliable. Also you seem to have a hidden assumtion that you should know the true geometric range to the satellite, which is true for timing receivers.

Wrt velocity, you're not wrong, but it would take a "dumb" attacker to simulate something unrealistic.