If I understand it correctly, the actual communications link between the drone and whoever is controlling it may be encrypted and uncompromised but all a hijacker needs to do is spoof the GPS signals itself coming from the satellites by, as you said, broadcasting alternate signals more powerfully in the vicinity of the drone.

But I could be wrong.