I think it is a vulnerability, yes. But it has worked so far, much like the "if hijacked, cooperate with hijackers and let things sort themselves out" doctrine that saved many lives until someone figured out how to game the rule (and cost as many lives as were ever saved).
Indeed, right now, we depend on these being rare cases, that can be dealt with in the methods used so far, which are surprisingly ham-handed: sending FCC radio trucks, civil air patrol or ham operators on transmitter hunts. It could be a great deal more difficult if you had concerted efforts by quasi-state actors acting on a large scale - not one rogue transmitter but 20 in each of 10 regions, and the transmitters are moving. Imagine an actor learned to perfectly mimic Kennedy Steve, and sat there on channel giving wrong instructions, or heterodyning key instructions.
And of course, if a quasi-state actor is involved, this could itself be part of a much larger scheme, such as simultaneously, 4 planes code hijackings while 19 cargo planes turn off their squawks entirely, all this to turn military eyes toward missing planes and away from their normal posts... So then somethiing else happens. This is what you can expect modern war to look like in a highly technological and networked society.
For all the technology, human workload is still the limiting factor - so such nuisance attacks would be all about creating excess workload and distraction for the guardians to put them off their normal game, so you can slip something through that would be otherwise impossible.
A huge amount of this kind of cyber-war is who is making workload for whom. You want the hackers to be the frustrated and overworked ones.
A solution for radio
Speaking of heterodyning, I was blown out of my seat by the Midway Southwest-Delta incident, where similar flight numbers acted on each others' instructions and -just like Tenerife- heterodyned over each other. Seriously? Still?? SMH...
I've been carrying Hedy Lamarr's frequency-hopping tech in my pocket since 1997 (CDMA). This allows a bunch - a whole bunch - of phones to share the same frequency block without stepping on each other, and it works. Obviously, this also authenticates the transmitter, since voice wasn't free in 1997.
And duplex radio is nothing new, that's where you receive on frequency R but transmit on frequency T, and the repeater transmits on R anything it hears on T. Combine them and it becomes a simple matter: the control tower transmits on one frequency, and planes use CDMA to talk to the tower. Every plane has a separate virtual channel, with encryption used for identification. When two planes talk at once, they both get through. Assuming the control tower configures it as a repeater so you hear all traffic, you hear both KLM and Pan Am. Even slicker, there are several possible ways to mute your own transmission, so KLM doesn't hear itself, they only hear Pan Am - and vice versa. This would be the everyday advantage.
During an attack, ATC can mute "that guy" or can mute all traffic except identified traffic, and ask unidentified traffic to ident in some alternate way, like "please touchtone 5 7 8", and keep changing the "CAPTCHA" as it were.
Stepping on CDMA is hard, because all radios are stepping on each other all the time normally. So it would be hard to block the tower's transmissions outward, or planes' inward.