None of the above. I agree with the Sunbeard Declaration.
Transponders may be spoofed, bu this will not defeat Imperial units. Anti-piracy is both political, military, and paramilitary. Transponders are widespread, and effective; and piracy exists throughout the unlit corners of the Imperium, but the instances are essentially unknown outside C,D & E systems. An unarmed merchant travelling alone through D & E systems will eventually be victimized, however. Convoys, armed merchants and patrols keep these to a minimum. An unarmed merchant typically will not go unescorted through such areas.
IMTU, transponders are within the Imperium are imperial tech, and any Imperial naval or scout vessel will have the technical capability to read the encrypted metadata, to determine if a transponder signal has been altered, and how. Like a license plate, any fool can look to see what cars have what plates; if I wanted, as a layman I could ask to see someone's registration. Another merchant can read a transponder, but likely not be able to determine if it has been spoofed. As a layman, though, I can not legitimately run someone's plate, though. A merchant can record and report, but not determine the authenticty of a transponder signal. Some police cars have ALPR systems, as do most tollbooths, and other locations; AFAIK, this has not been linked federally, yet, and there are some challenges. Similarly transponder signals are automatically read, checked for registration, and results; collection and transmission is finite. However, if I have a stolen car, which has been reported stolen, and I have any sophistication, I will avoid concentrations of populations (and thus of police) to minimize my chances of a mobile ALPR hit; I will not drive the main roads, where stationary ALPR will be, and indeed I will drive very little. If I need to drive far, I will snatch some plates that are unlikely to be missed, and run the backroads before going to ground. Pirates will similarly lay low, and stick far from the circle of light. I will still likely be caught sometime, as most criminals are, but like most criminals, it will likely not be for the first crime. Serial burglars have a mean of about 75 burglaries before they are caught. Pirates will similarly be short-term yahoos, who get caught soon, or long-term types who most likely get caught later.
So a merchant with a false transponder will be spotted by any patrol ship, or by any Imperial A or B starports. Type C and D starports may or may not have transponder reading capabilities, depending on a lot of factors. Pirates usually do not use starports, not the good ones. They stick to the outsystems of backwaters. In CT, the starship encounter tables said it all: no pirates in A or B systems. I cannot say where else in the CT canon I saw it, but I got the impression that ships can read each other's transponders, and spoofing them was possible. I did not get the impression that spoofing them was possible to Imperial Navy of IISS ships. Therefore, IMTU, which I try to make as close as I can to the OTU, full time pirates stay out of the A & B starport systems altogether. They might try a ruse in a class C system, and may try to lay low in a class D or E. To survive, they have to avoid any armed merchant, unless they have a Type C and some spare major assemblies; even then, combat will be rare. If armed merchants are able to give up their cargo, and not lose their ship, they may choose to do so to survive. In some cases, they may even give up passengers.
Just as full-time pirates have to keep in the corners, some armed merchants will look for a moment for an opportunistic target to jump. In this case, the merchant will spoof their transponder.
Piracy does not have to be a stable, rational career to exist, anymore than running a meth lab does.