Consider first the GPS signal. A bad actor can take them off line, quickly and without warning. Recovery would take time. With the increasing abandonment of ground based nav, this is increasingly a problem. At one of my business destinations, the on field VOR was decommissioned. It served approaches for 2 airports. The replacement RNAV/GPS was great because it bought an extra 400’ MDA/DH. Same at my base airport. VOR is gone. If GPS fails this airport is in good shape. It has two ILS. The other destination has nothing for 100 nm beyond the two local airports. Jamming is sufficient. Moving an airport with a false set of GPS signals or WAAS signal will accomplish its purpose too and that does have the potential to command autopilot changes.
The ADS-B and GPS messages are limited length and standardized. I agree with you that it would be impossible to cause a false sentence to be sent to the flight controls as the raw signal data is translated by the on board receivers.
The heart of the problem is the raw signal data is translated into these messages (or sentences in the NEMA description) and the raw signal can be blocked and spoofed/altered as we have seen. There are detection methods (RAIM) but the weak link remains the signal which communicates 3D position, and without redundancy, that signal is the key to everything. As you say, the spoofing cases were not sophisticated, but they were effective enough to be noticed worldwide.