If that were true, you'd be able to conceal your own access ID merely by encrypting your commlink. Also, for spoofing, it's not the target node's ID that you need, but rather the ID of a user with the right authorization. Further, you send spoof commands from your own device, but you're making it LOOK like it's coming from somewhere else.