Anyone can receive it, and many do. FlightRadar and others have networks of people with receivers that forward all received packets to central servers.
The aircraft self-report location, heading, altitude, etc, so anyone can transmit packets making ghost planes.
I am somewhat surprised nobody has stashed an ADS-B spoofer near ATL or AMS that just broadcasts tracks of A380 tail numbers crossing the runways perpendicular at 500 ft AGL or something. They have primary radar, sure, but I imagine there would still be a temporary disruption until people figured out what was going on.
I think this is the first case I’ve seen of ADS-B spoofing in the wild.
EDIT: this was spoofed reports to the data aggregators via the internet, not broadcast on radio waves. I’ve still never seen or heard tell of RF ADS-B spoofing.