I agree (except for the “cost very little” part).
I can forsee some problems. If his exploit works, the folks who own planes have no interest in making that information public, and therefore no interest in proving it works. If there is a reason that it won’t work that is obvious to them, they have little interest in conducting a test to prove that.
I don’t know what kind of money this security guy has, but I can’t imagine he’ll see much profit from the test, so he’s looking at spending several thousand dollars to rent a plane with no payoff when he’s proven right. Also, I know the FCC takes broadcasting on a frequency that is reserved for someone else very seriously, so I’m not sure he could conduct a full test of his method without breaking the law. And the folks who could give him permission to do so have very little motive to allow such a test for the reasons given above (If they know it will fail, they gain nothing, and if they know it will work they have a lot to lose).
I agree that a real demonstration of it working would be strong evidence, but I don’t see that as very likely in the near future, and I can see several good reasons for that that aren’t “it won’t work”, so we are left with zero evidence.