Not quite unspoofable, at least once the signal has been received for time-delayed rebroadcasting/meaconing.
But spoofing does become detectable by any receiver with a sufficiently accurate clock (I think for complete protection it would have to be an atomic clock though).
Recent news: https://www.euspa.europa.eu/newsroom-events/news/galileo-get...