Of course, vacuuming up everything is probably a great way to get caught quickly. For nefarious purposes it would probably more useful to selectively target individual devices.
https://hackaday.com/tag/cell-site-simulator/
https://www.evilsocket.net/2016/03/31/how-to-build-your-own-...
Unfortunately they're unlikely to do much about it until the consequences of NOT securing their networks hit them in the wallet, which is maybe where the script kiddies come in.
Some attacks abuse error indication prior authentication for location leaks and denial of service.
Once the connection is established, you're good.
Base stations receive a derivated key. If the base station is not connected to your provider's network, you cannot establish a connection due to the lack of a common key.
Did you know that simply owning a _typewriter_ was illegal without reporting it to communist authorities in east Europe?
Just to have a clear note here. Ham radio is regulated and there is certain traffic that you can run on free bands. That won't stop bad actors from ignoring these regulations.