How can ADS-B be secure when it is based on self-reporting?
Yes, one can send deliberately wrong position reports. But why would anyone want to do that? We're assuming malicious intent, of course -- but even so?

Could an attacker cause a collision using fake position broadcasts? It is hard to see how. The core meaning of an ADS-B broadcast is basically, "Dear ATC, please don't clear anyone to fly too near such-and-such point in space, because that's where I am." Getting an unsuspecting other aircraft to avoid a particular point in space where in reality nobody is, will not in itself cause any accident. At most some distraction and swearing and "no sir, I reallly don't see that traffic" transmissions.

An attacker might mount a denial of service attack against the airspace by flooding an air traffic controller's monitor with dummy aircraft, so he can't find any safe way to route the real planes he's talking to. But for that effect it's not really necessary to send any fake position reports -- simply jamming the 1090 MHz downlink frequency would do just as well, and not be significantly more illegal or harder to detect.

You could try to convince ATC that someone else is in a different place than they really are. However, unless you jam the entire frequency, ATC would still be able to hear their real position reports, and their computers would be able to tell that they have several inconsistent reports from the same airframe address. It would be simple to handle that by separating traffic from both reported positions (which they need to be able to anyway, just in case someone accidentally misconfigures their transponder with a wrong address), and then we're back in the DoS scenario.

Could a suicidal attacker go up in an airplane of his own and get to ram into somebody else while faking his position as far as ATC sees it? If that's your goal, it would certainly seem helpful to stop broadcasting yoru true position, but that doesn't mean that broadcasting a false position would buy you anything that you don't also get simply by pulling the plug on your transponder so you don't broadcast anything. In both cases your problem would be that you're now a primary radar echo that doesn't correspond to any transponder reply. Depending on where you pull the trick that may or may not set alarm bells ringing -- but to the extent it does, broadcasting a different position wouldn't do anything to silence them.

One thing you can do is rig your ADS-B Out to transmit a wrong altitude and hope to get clearance to pass directly above or below someone which you might then try to ram without being seen -- because primary radar is generally bad at distinguishing altitudes. However, that is not a risk specific to ADS-B -- good old SSR also depends on airborne transponders to self-report their altitude in Mode C, and that can be tampered with just as easily.