Correct. That is what almost all geostationary satellites are. If you want encryption, do it at the application layer.

Really depends on what the satellite does, and even for purely "dumb pipe" satellites you'll need some telemetry for stationkeeping, repositioning etc.

Practically, you'll also want to be able to reconfigure spot beam to backhaul mappings or even cross-connect some spot beams to cut satphone-to-satphone voice latency in half etc.

That's not even considering constellations like Iridium that do actual packet switching in space.

That seldom works. Simple repeaters transmit the strongest signal they get and can be easily hijacked by a rogue ground transmitter. This is the main reason simple repeaters on orbit went out of fashion in the 1980s.