Even worse, I was just reading (I think on Hackaday) that at least some DJI drones transmit both its location and the controller's location coordinates unencrypted.

The thing is, you take that into consideration and there's ways you can mitigate the risk in that. Also, how quickly can the Russian figure that signal out, convert the drone coordinates into whatever they use, and pass that to a gun or missle battalion fire direction center? As well as how quickly that FDC can get that to a gun/missle section that can engage that coordinates? I'm sure the Ukrainians can say, with fair accuracy by now.