[remael]

They could be employing some verification by using multilateration (time (difference) of arrival) between their receivers, which would make it a lot more resistant to spoofing.

EDIT: https://www.flightradar24.com/how-it-works#mlat

[jcims]

Definitely plausible for ATC installs.